Return 404 when attempting to access /error directly in production

Replaces #2212

modules/cms/classes/Controller.php

@@ -203,7 +203,7 @@ class Controller
         /*
          * If the page was not found, render the 404 page - either provided by the theme or the built-in one.
          */
-        if (!$page || $url === '404') {
+        if (!$page || $url === '404' || ($url === 'error' && !Config::get('app.debug', false))) {
             if (!Request::ajax()) {
                 $this->setStatusCode(404);
             }