[MM-58492][MM-58523] Fixed some access control bugs around archived channels by replacing the permission check with HasPermissionToReadChannel (#27409)

* [MM-58492][MM-58523] Fixed some access control bugs around archived channels by replacing the permission check with HasPermissionToReadChannel

* Fix lint, add ChannelId to uploads

* Fix MMCTL tests and remove unnecessary check for the error message that doesn't work anyways

* Include channel map for getting flagged posts

---------

Co-authored-by: Mattermost Build <build@mattermost.com>

server/channels/api4/preference.go

@@ -113,6 +113,7 @@ func updatePreferences(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	var sanitizedPreferences model.Preferences
+	channelMap := make(map[string]*model.Channel)
 
 	for _, pref := range preferences {
 		if pref.Category == model.PreferenceCategoryFlaggedPost {
@@ -122,7 +123,16 @@ func updatePreferences(c *Context, w http.ResponseWriter, r *http.Request) {
 				return
 			}
 
-			if !c.App.SessionHasPermissionToChannel(c.AppContext, *c.AppContext.Session(), post.ChannelId, model.PermissionReadChannelContent) {
+			channel, ok := channelMap[post.ChannelId]
+			if !ok {
+				channel, err = c.App.GetChannel(c.AppContext, post.ChannelId)
+				if err != nil {
+					c.Err = err
+					return
+				}
+			}
+
+			if !c.App.SessionHasPermissionToReadChannel(c.AppContext, *c.AppContext.Session(), channel) {
 				c.SetPermissionError(model.PermissionReadChannelContent)
 				return
 			}