MDL-86335 router: Hide detailed payload data for non-admins

public/lib/classes/router/middleware/validation_middleware.php

@@ -53,10 +53,18 @@ class validation_middleware implements MiddlewareInterface {
 
     #[\Override]
     public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface {
+        global $USER;
+
         try {
             $request = $this->requestvalidator->validate_request($request);
         } catch (\Exception $e) {
-            return $this->responsehandler->get_response_from_exception($request, $e);
+            $response = $this->responsehandler->get_response_from_exception($request, $e);
+            // Throw 'page not found' exception for non-admins.
+            // This hides stacktrace and errorcodes in detailed payload responses.
+            if (!is_siteadmin($USER->id) && $response->getStatusCode() == 404) {
+                return \core\router\util::throw_page_not_found($request, $response, $response->getReasonPhrase());
+            }
+            return $response;
         }
 
         $response = $handler->handle($request);