Merge pull request #6558 from pmusaraj/disallow-flagging-deleted-post

FIX: disable flagging hidden posts

app/assets/javascripts/discourse/widgets/post-menu.js.es6

@@ -109,7 +109,7 @@ registerButton("like-count", attrs => {
 });
 
 registerButton("flag", attrs => {
-  if (attrs.canFlag) {
+  if (attrs.canFlag && !attrs.hidden) {
     return {
       action: "showFlags",
       title: "post.controls.flag",

lib/guardian/post_guardian.rb

@@ -40,6 +40,9 @@ module PostGuardian
       # Silenced users can't flag
       return false if is_flag && @user.silenced?
 
+      # Hidden posts can't be flagged
+      return false if is_flag && post.hidden?
+
       # post made by staff, but we don't allow staff flags
       return false if is_flag &&
         (!SiteSetting.allow_flagging_staff?) &&

spec/components/guardian_spec.rb

@@ -116,6 +116,11 @@ describe Guardian do
       expect(Guardian.new(user).post_can_act?(post, :spam)).to be_truthy
     end
 
+    it "does not allow flagging of hidden posts" do
+      post.hidden = true
+      expect(Guardian.new(user).post_can_act?(post, :spam)).to be_falsey
+    end
+
     it "allows flagging of staff posts when allow_flagging_staff is true" do
       SiteSetting.allow_flagging_staff = true
       staff_post = Fabricate(:post, user: Fabricate(:moderator))

test/javascripts/widgets/post-test.js.es6

@@ -389,6 +389,16 @@ widgetTest(`flagging: can't flag`, {
   }
 });
 
+widgetTest(`flagging: can't flag when post is hidden`, {
+  template: '{{mount-widget widget="post" args=args}}',
+  beforeEach() {
+    this.set("args", { canFlag: true, hidden: true });
+  },
+  test(assert) {
+    assert.ok(this.$("button.create-flag").length === 0);
+  }
+});
+
 widgetTest(`read indicator`, {
   template: '{{mount-widget widget="post" args=args}}',
   beforeEach() {