q2a/question2answer — pull request #28 by pupi1985 (2014-02-02 03:32:25+00:00)
Title: Denied URL access to disabled pages in the Pages section

I noticed it is possible to access pages that are disabled in the Pages section by writing their URL.

For example, I see no *Categories* section in the [Q2A](http://www.question2answer.org) site. However, I'm still able to access that page through http://www.question2answer.org/qa/categories.

As a user, I would expect that disabling that page really blocks user access to it but it is not the case. This might also involve a security flaw which I mentioned a while ago in patch-3 (ac2fee937355a98ffc80b948e54d6514360cdd68) in which users can find out if a user exists in the login page and also even in the users page (where they can see all users).

Disabling the users page would only hide the link but all the users will still be there and could be accessed by bots. This patch disables access to those pages except the *Ask* page as that page could also be accessed from other links rather than the one in the menu and I don't think anyone would like to block access to that page either :)