Biest #465

lib/classes/JsonApi/Routes/Files/Authority.php

@@ -38,6 +38,11 @@ class Authority
         return $folder->isReadable($user->id);
     }
 
+    public static function canShowFolderFileRefs(User $user, \FolderType $folder)
+    {
+        return self::canShowFolder($user, $folder) || $folder->download_allowed;
+    }
+
     public static function canUpdateFolder(User $user, \FolderType $folder)
     {
         return $folder->isEditable($user->id);

lib/classes/JsonApi/Routes/Files/SubfilerefsIndex.php

@@ -24,7 +24,7 @@ class SubfilerefsIndex extends JsonApiController
             throw new RecordNotFoundException();
         }
 
-        if (!Authority::canShowFolder($this->getUser($request), $folder)) {
+        if (!Authority::canShowFolderFileRefs($this->getUser($request), $folder)) {
             throw new AuthorizationFailedException();
         }