Index: lams_central/src/java/org/lamsfoundation/lams/web/qb/QbStatsController.java
===================================================================
diff -u -ra7d8610afc324aabc205da72b1ce1709fafc5404 -r710d8ac52c4ea673fb2c2c8bf8d2c1f246fd12bf
--- lams_central/src/java/org/lamsfoundation/lams/web/qb/QbStatsController.java	(.../QbStatsController.java)	(revision a7d8610afc324aabc205da72b1ce1709fafc5404)
+++ lams_central/src/java/org/lamsfoundation/lams/web/qb/QbStatsController.java	(.../QbStatsController.java)	(revision 710d8ac52c4ea673fb2c2c8bf8d2c1f246fd12bf)
@@ -106,6 +106,10 @@
     @RequestMapping("/merge")
     public String mergeQuestions(@RequestParam long sourceQbQuestionUid, @RequestParam long targetQbQuestionUid,
 	    Model model) throws Exception {
+	if (!Configuration.getAsBoolean(ConfigurationKeys.QB_MERGE_ENABLE)) {
+	    throw new SecurityException("Question merging is disabled");
+	}
+
 	QbQuestion sourceQuestion = qbService.getQuestionByUid(sourceQbQuestionUid);
 	QbQuestion targetQuestion = qbService.getQuestionByUid(targetQbQuestionUid);
 	List<String> mergeErrors = new LinkedList<>();
Index: lams_central/web/qb/stats.jsp
===================================================================
diff -u -r21606f18aac597a4f64d761bd0e33e904e35a997 -r710d8ac52c4ea673fb2c2c8bf8d2c1f246fd12bf
--- lams_central/web/qb/stats.jsp	(.../stats.jsp)	(revision 21606f18aac597a4f64d761bd0e33e904e35a997)
+++ lams_central/web/qb/stats.jsp	(.../stats.jsp)	(revision 710d8ac52c4ea673fb2c2c8bf8d2c1f246fd12bf)
@@ -522,7 +522,7 @@
 		</c:otherwise>
 	</c:choose>
 	
-	<c:if test="${managementAllowed}">
+	<c:if test="${managementAllowed and mergeAllowed}">
 		<div class="panel panel-default">
 			<div class="panel-heading">
 				Merge this question with...