You could use a config file that has patterns that match directories to allow or deny. Like this:

Allow=/home/you/openfolder
Deny=/usr/.*
Deny=/bin/.*
Default=Allow
[download]

Then just run the pattern against the current directory, if it matched and Allow pattern then show it, if it matches a deny pattern then show an error. If it doesn't match either, you could set up a default directive.

Each user that uses the script would only need to setup one of these files or you could just keep track of their rights in a DB. You could authenticate, using a user/password and dropping a cookie.