[FIX] getUserMentionsByChannel method room permission (#25748)

apps/meteor/app/mentions/server/methods/getUserMentionsByChannel.js

@@ -2,6 +2,7 @@ import { Meteor } from 'meteor/meteor';
 import { check } from 'meteor/check';
 
 import { Rooms, Users, Messages } from '../../../models';
+import { canAccessRoom } from '../../../authorization/server';
 
 Meteor.methods({
 	getUserMentionsByChannel({ roomId, options }) {
@@ -13,16 +14,16 @@ Meteor.methods({
 			});
 		}
 
+		const user = Users.findOneById(Meteor.userId());
+
 		const room = Rooms.findOneById(roomId);
 
-		if (!room) {
+		if (!room || !canAccessRoom(room, user)) {
 			throw new Meteor.Error('error-invalid-room', 'Invalid room', {
 				method: 'getUserMentionsByChannel',
 			});
 		}
 
-		const user = Users.findOneById(Meteor.userId());
-
 		return Messages.findVisibleByMentionAndRoomId(user.username, roomId, options).fetch();
 	},
 });