October: Disabled plugin's controllers are still accessible

[alfreedom]

Expected behavior

The controller pages of a disabled plugin should not be displayed in the backend with the url of the page

Actual behavior

If you enter a page of a plugin using your url, show the page, regardless of whether the plugin is disabled

Reproduce steps

1. Go to a backend controller page of a plugin.
2. Copy the page url.
3. Disable the plugin in the configuration panel
4. Open the copied url again, the page will be show

October build

None

[w20k]

@LukeTowers - confirmed.
Sidebar is removed, but with absolute URL it's accessible.

Settings:

Plugins Page:

[LukeTowers]

@w20k could you look into why that's happening?

[w20k]

@LukeTowers, I will, already started debugging ;)

[w20k]

@LukeTowers, found the spot, but not yet sure about how plugins $id is generated (is it as simple as ucfirst($author) . '.' . ucfirst($plugin)? ).

It looks up for a plugin controller, but doesn't check if plugin is disabled or not.
https://github.com/octobercms/october/blob/master/modules/backend/classes/BackendController.php#L107

[LukeTowers]

@w20k you should be able to use this: https://github.com/octobercms/october/blob/master/modules/system/classes/PluginManager.php#L505

PluginManager::instance()->isDisabled($author . '\\' . $plugin);

That could probably go right after the list(author, plugin) call to prevent the further code from running

[w20k]

@LukeTowers tried this way while testing. Didn't work. Namespace and pluginsId should start with capitalized letters (namespace: October\Test or id: October.Test).
Could the URL be different from the pluginId? I guess not 😅

This worked like charm, will make a PR either today, or tomorrow.

if (!PluginManager::instance()->isDisabled(ucfirst($author) . '.' . ucfirst($plugin))){
....
}

[w20k]

Found one strange behaviour, looking at it right now.

@LukeTowers if it would open default blank backend page is it correct behaviour or should show 404?

[LukeTowers]

@w20k it should pass the request off to be handled by the CMS 404 page, or however a 404 in the backend typically works

[w20k]

Sorry for taking so looong ;)

PR Fix