FIX: do not show about page to anonymous users for private forums

app/controllers/about_controller.rb

@@ -5,8 +5,9 @@ class AboutController < ApplicationController
   before_filter :ensure_logged_in, only: [:live_post_counts]
 
   def index
-    @about = About.new
+    return redirect_to path('/login') if SiteSetting.login_required? && current_user.nil?
 
+    @about = About.new
     respond_to do |format|
       format.html do
         render :index

app/views/static/show.html.erb

@@ -1,7 +1,9 @@
 <div itemscope itemtype='http://schema.org/WebPage'>
   <meta itemprop='lastReviewed' content='<%= @topic.first_post.updated_at.to_date.to_formatted_s(:iso_8601) %>'>
   <ul class='nav-pills' role='navigation' itemscope itemtype='http://schema.org/SiteNavigationElement'>
+    <% unless SiteSetting.login_required? && current_user.nil? %>
       <li class="nav-item-about"><%= link_to t('about'), '/about' %></a></li>
+    <% end %>
     <% if @faq_overriden %>
       <li class='nav-item-guidelines'><a class='<%= @page == 'faq' ? 'active' : '' %>' href='<%= guidelines_path %>'><%= t 'guidelines' %></a></li>
       <li class='nav-item-faq'><a href='<%= faq_path %>'><%= t 'js.faq' %></a></li>

spec/controllers/about_controller_spec.rb

@@ -0,0 +1,26 @@
+require 'rails_helper'
+
+describe AboutController do
+
+  context '.index' do
+
+    it "should display the about page for anonymous user when login_required is false" do
+      SiteSetting.login_required = false
+      xhr :get, :index
+      expect(response).to be_success
+    end
+
+    it 'should redirect to login page for anonymous user when login_required is true' do
+      SiteSetting.login_required = true
+      xhr :get, :index
+      expect(response).to redirect_to '/login'
+    end
+
+    it "should display the about page for logged in user when login_required is true" do
+      SiteSetting.login_required = true
+      log_in
+      xhr :get, :index
+      expect(response).to be_success
+    end
+  end
+end