DEV: Only allow expanding hidden posts for author and staff (#21052)

lib/guardian/post_guardian.rb

@@ -269,7 +269,10 @@ module PostGuardian
       return false
     end
     return true if is_moderator? || is_category_group_moderator?(post.topic.category)
-    return true if !post.trashed? || can_see_deleted_post?(post)
+    if (!post.trashed? || can_see_deleted_post?(post)) &&
+         (!post.hidden? || can_see_hidden_post?(post))
+      return true
+    end
     false
   end
 
@@ -280,6 +283,11 @@ module PostGuardian
     post.deleted_by_id == @user.id && @user.has_trust_level?(TrustLevel[4])
   end
 
+  def can_see_hidden_post?(post)
+    return false if anonymous?
+    post.user_id == @user.id || @user.has_trust_level_or_staff?(TrustLevel[4])
+  end
+
   def can_view_edit_history?(post)
     return false unless post