fix: Users without preview permission possibility of subscribe to public channel stream

.changeset/lemon-lions-learn.md

@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+fixes the possibility of see new messages without being subscribed to a public channel.

apps/meteor/server/modules/notifications/notifications.module.ts

@@ -105,7 +105,8 @@ export class NotificationsModule {
 			if (!canAccess) {
 				// verify if can preview messages from public channels
 				if (room.t === 'c' && this.userId) {
-					return Authorization.hasPermission(this.userId, 'preview-c-room');
+					const subscription = await Subscriptions.findOne({ rid: room._id });
+					return !!subscription && Authorization.hasPermission(this.userId, 'preview-c-room');
 				}
 				return false;
 			}
@@ -186,6 +187,7 @@ export class NotificationsModule {
 			if (!this.userId) {
 				return false;
 			}
+
 			const canAccess = await Authorization.canAccessRoomId(room._id, this.userId);
 
 			return canAccess;