TYPO3 Core

In BackendUserAuthentication::getDefaultUploadFolder, the addFolder permission flag is checked instead of the writeFolder permission flag in determining whether the folder is writable and thus suitable as an upload target.

I found this issue while checking #77841, which would lead to users not getting the IRRE "Upload file" button if they didn't have the "addFolder" permission.

The steps from the other ticket can be used to reproduce this too:

1. Create a BE user with any mix of file operation permissions, as long as the "Folder/Directory Add" permission is not given, and "Write Folder" + "Add File" are given.
2. As the BE user, create a CE of the type "Text and Media".
3. Switch to the "Media" tab in the CE form
4. The button is not visible. Via the "Add media" button, files can still be uploaded.

In this case (with #77841 fixed) the button is not visible, due to (as can be seen when stepping through with e.g. XDebug) no folder suitable for uploading files can be found.