SECURITY: Hide user profiles from public

User profiles, including the summary, should be private to anonymous
users if hide_user_profiles_from_public is enabled.

spec/requests/users_controller_spec.rb

@@ -4151,6 +4151,24 @@ RSpec.describe UsersController do
       expect(json["user_summary"]["post_count"]).to eq(0)
     end
 
+    context "when `hide_user_profiles_from_public` site setting is enabled" do
+      before { SiteSetting.hide_user_profiles_from_public = true }
+
+      it "returns 200 for logged in users" do
+        sign_in(Fabricate(:user))
+
+        get "/u/#{user.username_lower}/summary.json"
+
+        expect(response.status).to eq(200)
+      end
+
+      it "returns 403 for anonymous users" do
+        get "/u/#{user.username_lower}/summary.json"
+
+        expect(response.status).to eq(403)
+      end
+    end
+
     context "when `hide_profile_and_presence` user option is checked" do
       before_all { user1.user_option.update_columns(hide_profile_and_presence: true) }