[MM-64453] Guest shouldn't discover public channels that they are not member of (#31327) (#33778)

Automatic Merge

server/channels/api4/channel.go

@@ -999,6 +999,15 @@ func getPublicChannelsByIdsForTeam(c *Context, w http.ResponseWriter, r *http.Re
 		return
 	}
 
+	if session := c.AppContext.Session(); session.IsGuest() {
+		for _, channel := range channels {
+			if !c.App.SessionHasPermissionToChannel(c.AppContext, *session, channel.Id, model.PermissionReadChannel) {
+				c.SetPermissionError(model.PermissionReadChannel)
+				return
+			}
+		}
+	}
+
 	appErr = c.App.FillInChannelsProps(c.AppContext, channels)
 	if appErr != nil {
 		c.Err = appErr