Remove hidden CMS pages from menus (#5309)

modules/cms/classes/Page.php

@@ -1,6 +1,7 @@
 <?php namespace Cms\Classes;
 
 use Lang;
+use BackendAuth;
 use ApplicationException;
 use October\Rain\Filesystem\Definitions as FileDefinitions;
 
@@ -197,6 +198,12 @@ class Page extends CmsCompoundObject
             }
 
             $page = self::loadCached($theme, $item->reference);
+
+            // Remove hidden CMS pages from menus when backend user is logged out
+            if ($page && $page->is_hidden && !BackendAuth::getUser()) {
+                return;
+            }
+
             $controller = Controller::getController() ?: new Controller;
             $pageUrl = $controller->pageUrl($item->reference, [], false);