Fix new thread private behaviour

app/blueprints/threads/__init__.py

@@ -289,7 +289,7 @@ def new():
 	if package is None and not current_user.rank.atLeast(UserRank.APPROVER):
 		abort(404)
 
-	allow_change = package and package.approved
+	allow_private_change = not package or package.approved
 	is_review_thread = package and not package.approved
 
 	# Check that user can make the thread
@@ -321,7 +321,7 @@ def new():
 		thread = Thread()
 		thread.author  = current_user
 		thread.title   = form.title.data
-		thread.private = form.private.data if allow_change else def_is_private
+		thread.private = form.private.data if allow_private_change else def_is_private
 		thread.package = package
 		db.session.add(thread)
 
@@ -369,7 +369,7 @@ def new():
 		return redirect(thread.getViewURL())
 
 
-	return render_template("threads/new.html", form=form, allow_private_change=allow_change, package=package)
+	return render_template("threads/new.html", form=form, allow_private_change=allow_private_change, package=package)
 
 
 @bp.route("/users/<username>/comments/")

app/templates/threads/new.html

@@ -35,10 +35,18 @@
 		</div>
 	</div>
 
-	{{ render_checkbox_field(form.private, class_="my-3") }}
-	<p>
-		{{ _("Only you, the package author, and users of Approver rank and above can read private threads.") }}
-	</p>
+	{% if allow_private_change %}
+		{{ render_checkbox_field(form.private, class_="my-3") }}
+	{% elif form.private.data %}
+		<p>
+			Private.
+		</p>
+	{% endif %}
+	{% if allow_private_change or form.private.data %}
+		<p>
+			{{ _("Only you, the package author, and users of Approver rank and above can read private threads.") }}
+		</p>
+	{% endif %}
 
 	{{ render_submit_field(form.submit) }}
 </form>