From 91f3e8e7244eb327dcf98dfba17b37529c8f9a80 Mon Sep 17 00:00:00 2001
From: Robin Ward <robin.ward@gmail.com>
Date: Tue, 15 Sep 2015 12:29:15 -0400
Subject: [PATCH] For now, restrict whispering to staff only.

---
 app/assets/javascripts/discourse/controllers/composer.js.es6 | 3 ++-
 app/controllers/posts_controller.rb                          | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/assets/javascripts/discourse/controllers/composer.js.es6 b/app/assets/javascripts/discourse/controllers/composer.js.es6
index d6d1224f53e..9e5b2206d0a 100644
--- a/app/assets/javascripts/discourse/controllers/composer.js.es6
+++ b/app/assets/javascripts/discourse/controllers/composer.js.es6
@@ -67,7 +67,8 @@ export default Ember.Controller.extend({
 
   @computed('model.action')
   canWhisper(action) {
-    return this.siteSettings.enable_whispers && action === Composer.REPLY;
+    const currentUser = this.currentUser;
+    return currentUser && currentUser.get('staff') && this.siteSettings.enable_whispers && action === Composer.REPLY;
   },
 
   showWarning: function() {
diff --git a/app/controllers/posts_controller.rb b/app/controllers/posts_controller.rb
index 5ee72c315ac..b7c321ed953 100644
--- a/app/controllers/posts_controller.rb
+++ b/app/controllers/posts_controller.rb
@@ -465,7 +465,7 @@ class PostsController < ApplicationController
       result[:is_warning] = false
     end
 
-    if SiteSetting.enable_whispers? && params[:whisper] == "true"
+    if current_user.staff? && SiteSetting.enable_whispers? && params[:whisper] == "true"
       result[:post_type] = Post.types[:whisper]
     end