closes #5015

src/posts/delete.js

@@ -17,7 +17,7 @@ module.exports = function (Posts) {
 				plugins.fireHook('filter:post.delete', {pid: pid, uid: uid}, next);
 			},
 			function (data, next) {
-				Posts.setPostField(pid, 'deleted', 1, next);
+				Posts.setPostFields(pid, {deleted: 1, deleterUid: uid}, next);
 			},
 			function (next) {
 				Posts.getPostFields(pid, ['pid', 'tid', 'uid', 'timestamp'], next);
@@ -53,7 +53,7 @@ module.exports = function (Posts) {
 				plugins.fireHook('filter:post.restore', {pid: pid, uid: uid}, next);
 			},
 			function (data, next) {
-				Posts.setPostField(pid, 'deleted', 0, next);
+				Posts.setPostFields(pid, {deleted: 0, deleterUid: 0}, next);
 			},
 			function (next) {
 				Posts.getPostFields(pid, ['pid', 'tid', 'uid', 'content', 'timestamp'], next);

src/privileges/posts.js

@@ -158,7 +158,7 @@ module.exports = function (privileges) {
 		var postData;
 		async.waterfall([
 			function (next) {
-				posts.getPostFields(pid, ['tid', 'timestamp'], next);
+				posts.getPostFields(pid, ['uid', 'tid', 'timestamp', 'deleterUid'], next);
 			},
 			function (_postData, next) {
 				postData = _postData;
@@ -190,8 +190,9 @@ module.exports = function (privileges) {
 			if (postDeleteDuration && (Date.now() - parseInt(postData.timestamp, 10) > postDeleteDuration * 1000)) {
 				return callback(null, {flag: false, message: '[[error:post-delete-duration-expired, ' + meta.config.postDeleteDuration + ']]'});
 			}
-
+			var deleterUid = parseInt(postData.deleterUid, 10) || 0;
-			callback(null, {flag: results.isOwner, message: '[[error:no-privileges]]'});
+			var flag = results.isOwner && (deleterUid === 0 || deleterUid === parseInt(postData.uid, 10));
+			callback(null, {flag: flag, message: '[[error:no-privileges]]'});
 		});
 	};