Index: lams_central/src/java/org/lamsfoundation/lams/web/qb/QbStatsController.java
===================================================================
diff -u -re00ee97b803f195e523abcd3f765513a58a03d32 -r5040f0c9ea761a4189272de822e5736f21b3bfe1
--- lams_central/src/java/org/lamsfoundation/lams/web/qb/QbStatsController.java	(.../QbStatsController.java)	(revision e00ee97b803f195e523abcd3f765513a58a03d32)
+++ lams_central/src/java/org/lamsfoundation/lams/web/qb/QbStatsController.java	(.../QbStatsController.java)	(revision 5040f0c9ea761a4189272de822e5736f21b3bfe1)
@@ -106,6 +106,10 @@
     @RequestMapping("/merge")
     public String mergeQuestions(@RequestParam long sourceQbQuestionUid, @RequestParam long targetQbQuestionUid,
 	    Model model) throws Exception {
+	if (!Configuration.getAsBoolean(ConfigurationKeys.QB_MERGE_ENABLE)) {
+	    throw new SecurityException("Question merging is disabled");
+	}
+
 	QbQuestion sourceQuestion = qbService.getQuestionByUid(sourceQbQuestionUid);
 	QbQuestion targetQuestion = qbService.getQuestionByUid(targetQbQuestionUid);
 	List<String> mergeErrors = new LinkedList<>();
Index: lams_central/web/qb/stats.jsp
===================================================================
diff -u -re00ee97b803f195e523abcd3f765513a58a03d32 -r5040f0c9ea761a4189272de822e5736f21b3bfe1
--- lams_central/web/qb/stats.jsp	(.../stats.jsp)	(revision e00ee97b803f195e523abcd3f765513a58a03d32)
+++ lams_central/web/qb/stats.jsp	(.../stats.jsp)	(revision 5040f0c9ea761a4189272de822e5736f21b3bfe1)
@@ -535,7 +535,7 @@
 		</c:otherwise>
 	</c:choose>
 	
-	<c:if test="${managementAllowed}">
+	<c:if test="${managementAllowed and mergeAllowed}">
 		<div class="panel panel-default">
 			<div class="panel-heading">
 				Merge this question with...