closes #5885

package.json

@@ -66,9 +66,9 @@
     "nodebb-plugin-spam-be-gone": "0.5.1",
     "nodebb-rewards-essentials": "0.0.9",
     "nodebb-theme-lavender": "4.0.5",
-    "nodebb-theme-persona": "5.0.29",
+    "nodebb-theme-persona": "5.0.30",
     "nodebb-theme-slick": "1.1.0",
-    "nodebb-theme-vanilla": "6.0.23",
+    "nodebb-theme-vanilla": "6.0.24",
     "nodebb-widget-essentials": "3.0.1",
     "nodemailer": "2.6.4",
     "nodemailer-sendmail-transport": "1.0.0",

src/controllers/accounts/helpers.js

@@ -182,9 +182,8 @@ function filterLinks(links, states) {
 			admin: true,
 		}, link.visibility);
 
-		// Iterate through states and permit if every test passes (or is not defined)
 		var permit = Object.keys(states).some(function (state) {
-			return states[state] === link.visibility[state];
+			return states[state] && link.visibility[state];
 		});
 
 		links[index].public = permit;

src/privileges/posts.js

@@ -10,6 +10,7 @@ var topics = require('../topics');
 var user = require('../user');
 var helpers = require('./helpers');
 var plugins = require('../plugins');
+var utils = require('../utils');
 
 module.exports = function (privileges) {
 	privileges.posts = {};
@@ -190,6 +191,22 @@ module.exports = function (privileges) {
 		], callback);
 	};
 
+	privileges.posts.canFlag = function (pid, uid, callback) {
+		async.waterfall([
+			function (next) {
+				async.parallel({
+					userReputation: async.apply(user.getUserField, uid, 'reputation'),
+					isAdminOrMod: async.apply(isAdminOrMod, pid, uid),
+				}, next);
+			},
+			function (results, next) {
+				var minimumReputation = utils.isNumber(meta.config['privileges:flag']) ? parseInt(meta.config['privileges:flag'], 10) : 1;
+				var canFlag = results.isAdminOrMod || parseInt(results.userReputation, 10) >= minimumReputation;
+				next(null, { flag: canFlag });
+			},
+		], callback);
+	};
+
 	privileges.posts.canMove = function (pid, uid, callback) {
 		async.waterfall([
 			function (next) {

src/socket.io/posts/tools.js

@@ -31,6 +31,9 @@ module.exports = function (SocketPosts) {
 					canDelete: function (next) {
 						privileges.posts.canDelete(data.pid, socket.uid, next);
 					},
+					canFlag: function (next) {
+						privileges.posts.canFlag(data.pid, socket.uid, next);
+					},
 					bookmarked: function (next) {
 						posts.hasBookmarked(data.pid, socket.uid, next);
 					},
@@ -49,6 +52,7 @@ module.exports = function (SocketPosts) {
 				results.posts.selfPost = socket.uid && socket.uid === parseInt(results.posts.uid, 10);
 				results.posts.display_edit_tools = results.canEdit.flag;
 				results.posts.display_delete_tools = results.canDelete.flag;
+				results.posts.display_flag_tools = socket.uid && !results.posts.selfPost && results.canFlag.flag;
 				results.posts.display_moderator_tools = results.posts.display_edit_tools || results.posts.display_delete_tools;
 				results.posts.display_move_tools = results.isAdminOrMod;
 				next(null, results);