My site is returning a 404 error for users who have tried to access a restricted page. I understand that this can be seen as a useful security features, however, I would like to return a 403 error instead.
I note that drupal is recording "access denied" in the logs, but somehow this is getting converted to a 404 for the user.
I have tried changing theme to see if that helps, and had no success. I have also removed custom 404 and 403 pages but this did not help either.
Googling the problem found the following file, drupal/core/lib/Drupal/Core/Controller/ExceptionController.php. This does not seem to exist in my installation of drupal.
I am not confident (or competent!) at altering php files.
Any help that can be provided would be greatly appreciated, as I am at a loss on how to proceed.