From 5344edc2a762480d8f39712baa52f626233a7295 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bar=C4=B1=C5=9F=20Soner=20U=C5=9Fakl=C4=B1?=
 <baris@nodebb.org>
Date: Fri, 18 Aug 2017 20:08:19 -0400
Subject: [PATCH] closes #5885

---
 package.json                        |  4 ++--
 src/controllers/accounts/helpers.js |  3 +--
 src/privileges/posts.js             | 17 +++++++++++++++++
 src/socket.io/posts/tools.js        |  4 ++++
 4 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/package.json b/package.json
index 56a606d617..b2b7e352c0 100644
--- a/package.json
+++ b/package.json
@@ -66,9 +66,9 @@
     "nodebb-plugin-spam-be-gone": "0.5.1",
     "nodebb-rewards-essentials": "0.0.9",
     "nodebb-theme-lavender": "4.0.5",
-    "nodebb-theme-persona": "5.0.29",
+    "nodebb-theme-persona": "5.0.30",
     "nodebb-theme-slick": "1.1.0",
-    "nodebb-theme-vanilla": "6.0.23",
+    "nodebb-theme-vanilla": "6.0.24",
     "nodebb-widget-essentials": "3.0.1",
     "nodemailer": "2.6.4",
     "nodemailer-sendmail-transport": "1.0.0",
diff --git a/src/controllers/accounts/helpers.js b/src/controllers/accounts/helpers.js
index 5bd65a33af..e35ac514d9 100644
--- a/src/controllers/accounts/helpers.js
+++ b/src/controllers/accounts/helpers.js
@@ -182,9 +182,8 @@ function filterLinks(links, states) {
 			admin: true,
 		}, link.visibility);
 
-		// Iterate through states and permit if every test passes (or is not defined)
 		var permit = Object.keys(states).some(function (state) {
-			return states[state] === link.visibility[state];
+			return states[state] && link.visibility[state];
 		});
 
 		links[index].public = permit;
diff --git a/src/privileges/posts.js b/src/privileges/posts.js
index 89ef1e0f48..f2bfe38428 100644
--- a/src/privileges/posts.js
+++ b/src/privileges/posts.js
@@ -10,6 +10,7 @@ var topics = require('../topics');
 var user = require('../user');
 var helpers = require('./helpers');
 var plugins = require('../plugins');
+var utils = require('../utils');
 
 module.exports = function (privileges) {
 	privileges.posts = {};
@@ -190,6 +191,22 @@ module.exports = function (privileges) {
 		], callback);
 	};
 
+	privileges.posts.canFlag = function (pid, uid, callback) {
+		async.waterfall([
+			function (next) {
+				async.parallel({
+					userReputation: async.apply(user.getUserField, uid, 'reputation'),
+					isAdminOrMod: async.apply(isAdminOrMod, pid, uid),
+				}, next);
+			},
+			function (results, next) {
+				var minimumReputation = utils.isNumber(meta.config['privileges:flag']) ? parseInt(meta.config['privileges:flag'], 10) : 1;
+				var canFlag = results.isAdminOrMod || parseInt(results.userReputation, 10) >= minimumReputation;
+				next(null, { flag: canFlag });
+			},
+		], callback);
+	};
+
 	privileges.posts.canMove = function (pid, uid, callback) {
 		async.waterfall([
 			function (next) {
diff --git a/src/socket.io/posts/tools.js b/src/socket.io/posts/tools.js
index c075a96a8e..7f80ce9805 100644
--- a/src/socket.io/posts/tools.js
+++ b/src/socket.io/posts/tools.js
@@ -31,6 +31,9 @@ module.exports = function (SocketPosts) {
 					canDelete: function (next) {
 						privileges.posts.canDelete(data.pid, socket.uid, next);
 					},
+					canFlag: function (next) {
+						privileges.posts.canFlag(data.pid, socket.uid, next);
+					},
 					bookmarked: function (next) {
 						posts.hasBookmarked(data.pid, socket.uid, next);
 					},
@@ -49,6 +52,7 @@ module.exports = function (SocketPosts) {
 				results.posts.selfPost = socket.uid && socket.uid === parseInt(results.posts.uid, 10);
 				results.posts.display_edit_tools = results.canEdit.flag;
 				results.posts.display_delete_tools = results.canDelete.flag;
+				results.posts.display_flag_tools = socket.uid && !results.posts.selfPost && results.canFlag.flag;
 				results.posts.display_moderator_tools = results.posts.display_edit_tools || results.posts.display_delete_tools;
 				results.posts.display_move_tools = results.isAdminOrMod;
 				next(null, results);