SECURITY: do not show private topic title on /unsubscribed page

app/controllers/email_controller.rb

@@ -110,10 +110,11 @@ class EmailController < ApplicationController
 
   def unsubscribed
     @email = params[:email]
+    @topic_id = params[:topic_id]
     user = User.find_by_email(params[:email])
     raise Discourse::NotFound unless user
-    @topic = Topic.find_by(id: params[:topic_id].to_i) if params[:topic_id]
-    raise Discourse::NotFound unless Guardian.new(user).can_see?(@topic)
+    topic = Topic.find_by(id: params[:topic_id].to_i) if @topic_id
+    @topic = topic if topic && Guardian.new(nil).can_see?(topic)
   end
 
 end

app/views/email/unsubscribed.html.erb

@@ -7,8 +7,8 @@
   </p>
 
   <% if @topic %>
-  <p>
-    <%=t("unsubscribed.topic_description", link: render_topic_title(@topic)).html_safe%>
-  </p>
+    <p><%=t("unsubscribed.topic_description", link: render_topic_title(@topic)).html_safe%></p>
+  <% elsif @topic_id %>
+    <p><%=t("unsubscribed.private_topic_description")%></p>
   <% end %>
 </div>