guard save template message

app/controllers/submissions_controller.rb

@@ -40,7 +40,7 @@ class SubmissionsController < ApplicationController
   def create
     return redirect_to template_path(@template), alert: I18n.t('template_has_been_archived') if @template.archived_at?
 
-    save_template_message(@template, params) if params[:save_message] == '1'
+    save_template_message(@template, params) if params[:save_message] == '1' && can?(:update, @template)
 
     [params.delete(:subject), params.delete(:body)] if params[:is_custom_message] != '1'
 

app/views/submissions/_send_email_base.html.erb

@@ -69,7 +69,7 @@
         <%= f.label :message, t('body'), class: 'label' %>
         <% body_variables = AccountConfig::EMAIL_VARIABLES[AccountConfig::SUBMITTER_INVITATION_EMAIL_KEY] %>
         <%= render 'personalization_settings/email_body_editor', name: f.field_name(:body), value: local_assigns[:submitter_email_message]&.normalized_body.presence || (is_edit_viewer ? view_template_body : nil) || submitter_preferences_index.dig(local_assigns[:submitter]&.uuid, 'request_email_body').presence || (is_edit_viewer ? view_config.value['body'] : default_body), variables: body_variables %>
-        <% if !local_assigns.fetch(:disable_save_as_default_template_option, false) && config.value['body_type'] != 'html' %>
+        <% if !local_assigns.fetch(:disable_save_as_default_template_option, false) && config.value['body_type'] != 'html' && template && can?(:update, template) %>
           <label for="<%= uuid = SecureRandom.uuid %>" class="flex items-center cursor-pointer">
             <%= check_box_tag :save_message, id: uuid, class: 'base-checkbox', checked: false %>
             <span class="label"><%= t('save_as_default_template_message') %></span>