Permissions: Web UI does not properly check for Download permission for files

[rpocklin]

Permission Issue - there is a missing check for the 'D' on files to validate whether the Download option is shown in the File Sidebar.

Steps to reproduce

1. Remove the ability for a user to download a file extendedAttributes.push({ scope: 'permissions', key: 'download', enabled: false })
2. Using a new browser window, go to the Web UI and login as the user you modified.
3. Navigate to a file which the user could previously download.
4. Highlight the file.
5. 'Download' option is present in the Sidebar under Actions, yet clicking the download correctly gives a 403 Forbidden error (and will do every time).

Expected behaviour

Should not show 'Download' under actions.

Actual behaviour

Show 'Download' under actions.

Recommended Fix

Change this function:

web/packages/web-app-files/src/helpers/resources.js

Lines 63 to 66 in 589cf7e

	canDownload: function() {
	// TODO: as soon as we allow folder downloads as archive we want to return `true` here without exceptions
	return !isFolder
	},

To this:

    canDownload: function() {
      return !isFolder && this.permissions.indexOf('R') >= 0
    },

I have tested this on our own codebase with success.

See #5452 for a similar related issue for copying of files.

[kulmann]

oCIS has an X webdav permission now, which prohibits downloads. Was implemented in web with #10973