Prevent subscriptions and calls to rooms events that the user is not participating (#12558)

packages/rocketchat-mentions-flextab/server/publications/mentionedMessages.js

@@ -9,6 +9,9 @@ Meteor.publish('mentionedMessages', function(rid, limit = 50) {
 	if (!user) {
 		return this.ready();
 	}
+	if (!Meteor.call('canAccessRoom', rid, this.userId)) {
+		return this.ready();
+	}
 	const cursorHandle = RocketChat.models.Messages.findVisibleByMentionAndRoomId(user.username, rid, {
 		sort: {
 			ts: -1,

packages/rocketchat-message-pin/server/publications/pinnedMessages.js

@@ -10,6 +10,9 @@ Meteor.publish('pinnedMessages', function(rid, limit = 50) {
 	if (!user) {
 		return this.ready();
 	}
+	if (!Meteor.call('canAccessRoom', rid, this.userId)) {
+		return this.ready();
+	}
 	const cursorHandle = RocketChat.models.Messages.findPinnedByRoom(rid, { sort: { ts: -1 }, limit }).observeChanges({
 		added(_id, record) {
 			return publication.added('rocketchat_pinned_message', _id, record);

packages/rocketchat-message-snippet/server/publications/snippetedMessage.js

@@ -16,6 +16,10 @@ Meteor.publish('snippetedMessage', function(_id) {
 		},
 	};
 
+	if (!Meteor.call('canAccessRoom', snippet.rid, this.userId)) {
+		return this.ready();
+	}
+
 	if (RocketChat.models.Rooms.findOne(roomSnippetQuery) === undefined) {
 		return this.ready();
 	}

packages/rocketchat-message-snippet/server/publications/snippetedMessagesByRoom.js

@@ -13,6 +13,10 @@ Meteor.publish('snippetedMessages', function(rid, limit = 50) {
 		return this.ready();
 	}
 
+	if (!Meteor.call('canAccessRoom', rid, this.userId)) {
+		return this.ready();
+	}
+
 	const cursorHandle = RocketChat.models.Messages.findSnippetedByRoom(
 		rid,
 		{

packages/rocketchat-message-star/server/publications/starredMessages.js

@@ -9,6 +9,9 @@ Meteor.publish('starredMessages', function(rid, limit = 50) {
 	if (!user) {
 		return this.ready();
 	}
+	if (!Meteor.call('canAccessRoom', rid, this.userId)) {
+		return this.ready();
+	}
 	const cursorHandle = RocketChat.models.Messages.findStarredByUserAtRoom(this.userId, rid, {
 		sort: {
 			ts: -1,

server/lib/roomFiles.js

@@ -1,8 +1,14 @@
+import { Meteor } from 'meteor/meteor';
+
 export const roomFiles = (pub, { rid, searchText, limit = 50 }) => {
 	if (!pub.userId) {
 		return pub.ready();
 	}
 
+	if (!Meteor.call('canAccessRoom', rid, pub.userId)) {
+		return this.ready();
+	}
+
 	const cursorFileListHandle = RocketChat.models.Uploads.findNotHiddenFilesOfRoom(rid, searchText, limit).observeChanges({
 		added(_id, record) {
 			const { username, name } = record.userId ? RocketChat.models.Users.findOneById(record.userId) : {};