MM-38611 getSharedChannels: only return channels user is member of (#18417)

* getSharedChannels: only return channels user is member of

api4/shared_channel.go

@@ -27,10 +27,21 @@ func getSharedChannels(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// make sure user has access to the team.
+	if !c.App.SessionHasPermissionToTeam(*c.AppContext.Session(), c.Params.TeamId, model.PermissionViewTeam) {
+		c.SetPermissionError(model.PermissionViewTeam)
+		return
+	}
+
 	opts := model.SharedChannelFilterOpts{
 		TeamId: c.Params.TeamId,
 	}
 
+	// only return channels the user is a member of, unless they are a shared channels manager.
+	if !c.App.HasPermissionTo(c.AppContext.Session().UserId, model.PermissionManageSharedChannels) {
+		opts.MemberId = c.AppContext.Session().UserId
+	}
+
 	channels, appErr := c.App.GetSharedChannels(c.Params.Page, c.Params.PerPage, opts)
 	if appErr != nil {
 		c.Err = appErr

api4/shared_channel_test.go

@@ -64,9 +64,21 @@ func TestGetAllSharedChannels(t *testing.T) {
 	})
 
 	t.Run("get shared channels for invalid team", func(t *testing.T) {
-		channels, _, err := th.Client.GetAllSharedChannels(model.NewId(), 0, 100)
+		_, _, err := th.Client.GetAllSharedChannels(model.NewId(), 0, 100)
+		require.Error(t, err)
+	})
+
+	t.Run("get shared channels, user not member of team", func(t *testing.T) {
+		team := &model.Team{
+			DisplayName: "tteam",
+			Name:        GenerateTestTeamName(),
+			Type:        model.TeamOpen,
+		}
+		team, _, err := th.SystemAdminClient.CreateTeam(team)
 		require.NoError(t, err)
-		assert.Empty(t, channels)
+
+		_, _, err = th.Client.GetAllSharedChannels(team.Id, 0, 100)
+		require.Error(t, err)
 	})
 }