Jakub Zych
5471b66b8f
The plugin field-type upload route resolved a form extension's field without checking the extension's Permissions and Visible, so an administrator who cannot see the extension could still run its Upload. The route now answers 404 for them, like the extension's widget actions and partials.