Moodle: router (r.php) could expose application directories

@@ -53,10 +53,18 @@ public function __construct(
 
     #[\Override]
     public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface {
+        global $USER;
+
         try {
             $request = $this->requestvalidator->validate_request($request);
         } catch (\Exception $e) {
-            return $this->responsehandler->get_response_from_exception($request, $e);
+            $response = $this->responsehandler->get_response_from_exception($request, $e);
+            // Throw 'page not found' exception for non-admins.
+            // This hides stacktrace and errorcodes in detailed payload responses.
+            if (!is_siteadmin($USER->id) && $response->getStatusCode() == 404) {
+                return \core\router\util::throw_page_not_found($request, $response, $response->getReasonPhrase());
+            }
+            return $response;
         }
 
         $response = $handler->handle($request);

@@ -198,11 +198,14 @@ protected function add_middleware(): void {
      * Add the Error Handling Middleware to the RouteGroup.
      */
     protected function add_error_handler_middleware(): void {
+        global $CFG;
+        // Display error details only when debugging is on.
+        $displayerrordetails = !empty($CFG->debugdisplay);
         // Add the Error Handling Middleware and configure it to show Moodle Errors for HTML pages.
         $errormiddleware = new ErrorMiddleware(
             $this->app->getCallableResolver(),
             $this->app->getResponseFactory(),
-            displayErrorDetails: true,
+            displayErrorDetails: $displayerrordetails,
             logErrors: true,
             logErrorDetails: true,
         );