Nodebb: User is able to restore deleted posts

[exomarty]

Please include the following information when submitting a bug report/issue:

• NodeBB 1.1.2
• Database mongo
• Exact steps to cause this issue
  
  
  
  1. global mod deletes message
  
  
  2. After that user is able to restore post and edit it
  
  

Thank you!

[psychobunny]

Was that user the poster? That would be expected behavior currently, maybe purge instead?

[exomarty]

Yes. Of course was the poster.
purge is radical. Is important that another mod or admin can check also the post and restore it if needed.
I cant understand that to be a expected behavior

[julianlam]

I think what @exomarty is trying to get at is that if a mod or admin deletes a post, that should not allow the author to _un_delete it, as it was probably deleted for a reason (e.g. spam, offensive, etc)

[exomarty]

Correct @julianlam

[julianlam]

@barisusakli Perhaps "Restore post" should be a privilege too?

[pichalite]

I think topic posters should not be allowed to delete, restore or purge their posts. That part should be left to admins/mods.

[julianlam]

If delete privilege also meant you could/could not restore posts, I think I'd be ok with that.

[pichalite]

Yeah the privilege for delete posts should also apply to restore. This should be a marked as a bug.

[barisusakli]

If delete privilege also meant you could/could not restore posts, I think I'd be ok with that.

Yeah the privilege for delete posts should also apply to restore. This should be a marked as a bug.

This is already the case. If you remove the delete privilege from registered users they can't delete or restore their posts.

https://github.com/NodeBB/NodeBB/blob/master/src/posts/tools.js#L37-Lundefined