MM-45272: Fix getPostThread permissions (#20565)

Summary
Fix permissions for the the getPostThread API Method.
User can view thread if user is member of the channel
User can view threads in public channels (in the user's team) that they're not a member of, only if compliance export is disabled.

Ticket Link
https://mattermost.atlassian.net/browse/MM-45272

api4/post.go

@@ -525,6 +525,35 @@ func getPostThread(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	rPost, err := c.App.GetSinglePost(c.Params.PostId, false)
+	if err != nil {
+		c.Err = err
+		return
+	}
+	hasPermission := false
+	becauseCompliance := false
+	if c.App.SessionHasPermissionToChannel(c.AppContext, *c.AppContext.Session(), rPost.ChannelId, model.PermissionReadChannel) {
+		hasPermission = true
+	} else if channel, cErr := c.App.GetChannel(c.AppContext, rPost.ChannelId); cErr == nil {
+		if channel.Type == model.ChannelTypeOpen &&
+			c.App.SessionHasPermissionToTeam(*c.AppContext.Session(), channel.TeamId, model.PermissionReadPublicChannel) {
+			hasPermission = true
+			if *c.App.Config().MessageExportSettings.EnableExport {
+				hasPermission = false
+				becauseCompliance = true
+			}
+		}
+	}
+
+	if !hasPermission {
+		if becauseCompliance {
+			c.Err = model.NewAppError("getPostThread", "api.post.compliance_enabled.join_channel_to_view_post", nil, "", http.StatusForbidden)
+		} else {
+			c.SetPermissionError(model.PermissionReadChannel)
+		}
+		return
+	}
+
 	// For now, by default we return all items unless it's set to maintain
 	// backwards compatibility with mobile. But when the next ESR passes, we need to
 	// change this to web.PerPageDefault.