There should be a control to upload an image (and optionally crop and resize it) in the view and be able to refer to this image in the template.
Images (and documents like PDF) should be protected the same way the view is. i.e. You need at least read permission to be able to view the image (or document).