FIX: if badges are disabled badge pages should 404

app/controllers/badges_controller.rb

@@ -2,6 +2,8 @@ class BadgesController < ApplicationController
   skip_before_filter :check_xhr, only: [:index, :show]
 
   def index
+    raise Discourse::NotFound unless SiteSetting.enable_badges
+
     badges = Badge.all
 
     if (params[:only_listable] == "true") || !request.xhr?
@@ -28,6 +30,8 @@ class BadgesController < ApplicationController
   end
 
   def show
+    raise Discourse::NotFound unless SiteSetting.enable_badges
+
     params.require(:id)
     badge = Badge.enabled.find(params[:id])