Can someone send me files without my permission?

By default, incoming files are accepted automatically. If you want to approve each transfer before it starts, enable Confirm before receiving in Settings. When enabled, a dialog appears asking whether to accept or reject files from each sender. Once you accept a sender, all files in that batch are accepted automatically -- you do not get prompted for every single file.