q2a/question2answer — pull request #29 by pupi1985 (2014-02-02 03:58:59+00:00)
Title: Denied URL access to disabled pages in the Pages section

*After messing up with the branches and creating a pull request to the q2a/master branch I'm recreating the pull request from scratch. Let's see if this time I do it right :)*

I noticed that when disabling sections in the *Admin > Pages* section all you do is just hiding the link. However, these pages can still be accessed by URL. A clear example of this situation is the [Q2A](http://www.question2answer.org) site in which the *Categories* section is disables but can still be accessed by http://www.question2answer.org/qa/categories.

As a user, I feel this is not the right behavior. If I disable a page I would expect it not be accessed by any means. Hiding it from the menu doesn't make much difference. This is also related to a security flaw I mentioned in a patch-3 (ac2fee937355a98ffc80b948e54d6514360cdd68) in which failed login attempts let the person/bot on the other site see if the user actually existed. This relates to this issue because there is no way to fully hide the *Users* page and that is giving away information to bots.

Hopefully, this patch would allow users to really hide those pages.