> "Local" shares are available for admins only. And if you are an admin, you have a legitimate option of just mounting the local root filesystem and browsing it all you want.

But anybody can call this AJAX file directly. You just check whether the user is logged-in, but not the permissions.

Such permissions checks has to be performed on every single file.