feat: return generic 404 on invalid confirm code

src/controllers/index.js

@@ -222,13 +222,20 @@ Controllers.registerInterstitial = async function (req, res, next) {
 	}
 };
 
-Controllers.confirmEmail = function (req, res) {
+Controllers.confirmEmail = async (req, res, next) => {
-	user.email.confirmByCode(req.params.code, (err) => {
+	try {
+		await user.email.confirmByCode(req.params.code, req.session.id);
+	} catch (e) {
+		if (e.message === '[[error:invalid-data]]') {
+			return next();
+		}
+
+		throw e;
+	}
+
 	res.render('confirm', {
-			error: err ? err.message : '',
 		title: '[[pages:confirm]]',
 	});
-	});
 };
 
 Controllers.robots = function (req, res) {