feat: return generic 404 on invalid confirm code

src/controllers/index.js

@@ -222,12 +222,19 @@ Controllers.registerInterstitial = async function (req, res, next) {
 	}
 };
 
-Controllers.confirmEmail = function (req, res) {
+Controllers.confirmEmail = async (req, res, next) => {
-	user.email.confirmByCode(req.params.code, (err) => {
+	try {
-		res.render('confirm', {
+		await user.email.confirmByCode(req.params.code, req.session.id);
-			error: err ? err.message : '',
+	} catch (e) {
-			title: '[[pages:confirm]]',
+		if (e.message === '[[error:invalid-data]]') {
-		});
+			return next();
+		}
+
+		throw e;
+	}
+
+	res.render('confirm', {
+		title: '[[pages:confirm]]',
 	});
 };