InternalUser has home directory on OES server (so "My Files" is stored on OES).
InternalUser has full rights to all folders (RWCEMF rights)
InternalUser shares FolderA in "My Files" to with Contributor access
admin changes file system rights for InternalUser in FolderA to RF only
InternalUser now has read-only rights to FolderA when logged into Filr can still upload and delete files in FolderA, even though the user who shared the folder to him no longer has such rights

This all worked fine in Filr 3, but it's broken in Filr 4. I had an elaborate system setup to share a specific folder structure with external users, allowing them to upload/delete files in certain directories while restricting most folders to Read-only. Now all the external users can delete files they shouldn't be able to. Going to have to go back to Filr 3 if there's no fix for this.