Yes, the web users are given the permission to access shared resources, that specified in domain.xml & server.policy file under the <glassfishroot>\domains\domain1\config path.
One of the options,You can achieve your permissions by updating your domain.xml file docroot (bold text).
<virtual-server hosts="${com.sun.aas.hostName}" http-listeners="http-listener-1,http-listener-2" id="server" log-file="${com.sun.aas.instanceRoot}/logs/server.log" state="on">
[b][u] <property name="docroot" value="C:/moodle"/>[/u][/b]
<property name="accesslog" value="${com.sun.aas.instanceRoot}/logs/access"/>
<property name="sso-enabled" value="false"/>
</virtual-server>
[Message sent by forum member 'chameera' (chameera)]
http://forums.java.net/jive/thread.jspa?messageID=353512