From 2c7747fc98bfa02ac72434fed821c32cec9a3048 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bj=C3=B6rn=20Fromme?= <fromme@dreipunktnull.com>
Date: Thu, 14 Mar 2024 11:33:50 +0100
Subject: [PATCH] fix: don't show 'access denied' flash message to anonymous
 users

---
 src/EventListener/AccessDeniedListener.php | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/src/EventListener/AccessDeniedListener.php b/src/EventListener/AccessDeniedListener.php
index edb3398..7921862 100644
--- a/src/EventListener/AccessDeniedListener.php
+++ b/src/EventListener/AccessDeniedListener.php
@@ -2,6 +2,7 @@
 
 namespace App\EventListener;
 
+use App\Entity\User;
 use Psr\Log\LoggerInterface;
 use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
@@ -30,18 +31,24 @@ class AccessDeniedListener
 
         $request = $event->getRequest();
 
+        // Ignore ajax requests
         if ($request->isXmlHttpRequest()) {
             return;
         }
 
-        $request->getSession()->getFlashBag()->add('error', 'Zugriff verweigert');
-
         $this->logger->warning('Access denied', [
             'uri' => $request->getRequestUri(),
         ]);
 
+        $redirectRoute = 'app_index';
+
         $user = $this->security->getUser();
-        $redirectRoute = $user ? $user->getDefaultRoute() : 'app_index';
+
+        // Show flash message to authenticated users only
+        if ($user instanceof User) {
+            $request->getSession()->getFlashBag()->add('error', 'Zugriff verweigert');
+            $redirectRoute = $user->getDefaultRoute();
+        }
 
         $event->setResponse(new RedirectResponse($this->urlGenerator->generate($redirectRoute)));
     }