Probably the easiest way is to create an extension that is fired by these hooks:
https://docs.expressionengine.com/latest/development/extension-hooks/cp/css.html
https://docs.expressionengine.com/latest/development/extension-hooks/cp/javascript.html
Then you can just inject JavaScript and CSS in to your Control Panel.
Here's an example of the two methods you could fire in your extension:
function add_cp_tweaks_css()
{
$css .= file_get_contents(PATH_THIRD."my_cp_extension/css/cp.css");
return ee()->extensions->last_call . "\n" . $css;
}
function add_cp_tweaks_js()
{
$js .= file_get_contents(PATH_THIRD."my_cp_extension/js/cp.js");;
return ee()->extensions->last_call . "\n" . $js;
}
Then in your CSS file and JavaScript file, just manipulate the DOM as necessary.
// cp.css
.my-message {
font-weight: bold;
}
// cp.js
$(".t-0").prepend('<div class="my-message">You are not allowed to add pictures. Contact an admin.</div>');
Based on your use case, you'll need to probably want to add checks to make sure you only insert your JavaScript and CSS on Entry pages, and also want to check what user group the member is so you don't add the message to SuperAdmins or those who are allowed. So something like this:
$user_group_to_show_message = 10;
$referer = (array_key_exists('HTTP_REFERER',$_SERVER) ? $_SERVER['HTTP_REFERER'] : '');
// Check if we're on a publish page
preg_match('/.*publish\/(create|edit\/entry)\/([0-9]+).*/', $referer, $match);
if (array_key_exists(2,$match)
&& is_numeric($match[2])
&& ee()->session->userdata('group_id') === $user_group_to_show_message) {
// We are on a Publish page, with the right user group to warn, go ahead and add CSS/JS
}