Broken Access Control in Backend Module in sf_event_mgt

@@ -311,8 +311,7 @@ public function exportAction(int $eventUid): void
     {
         /** @var Event $event */
         $event = $this->eventRepository->findByUidIncludeHidden($eventUid);
-        if ($event !== null) {
-            $this->checkEventAccess($event);
+        if ($event !== null && $this->checkEventAccess($event)) {
             $this->exportService->downloadRegistrationsCsv($eventUid, $this->settings['csvExport'] ?? []);
         }
         exit();
@@ -339,7 +338,10 @@ public function handleExpiredRegistrationsAction(): ResponseInterface
      */
     public function indexNotifyAction(Event $event): ResponseInterface
     {
-        $this->checkEventAccess($event);
+        if (!$this->checkEventAccess($event)) {
+            return $this->redirect('list');
+        }
+
         $customNotification = GeneralUtility::makeInstance(CustomNotification::class);
         $customNotifications = $this->settingsService->getCustomNotifications($this->settings);
         $logEntries = $this->customNotificationLogRepository->findByEvent($event);
@@ -392,7 +394,10 @@ public function getNotificationRecipients(): array
      */
     public function notifyAction(Event $event, CustomNotification $customNotification): ResponseInterface
     {
-        $this->checkEventAccess($event);
+        if (!$this->checkEventAccess($event)) {
+            return $this->redirect('list');
+        }
+
         $customNotifications = $this->settingsService->getCustomNotifications($this->settings);
         $result = $this->notificationService->sendCustomNotification($event, $customNotification, $this->settings);
         $this->notificationService->createCustomNotificationLogentry(
@@ -410,19 +415,20 @@ public function notifyAction(Event $event, CustomNotification $customNotificatio
 
     /**
      * Checks if the current backend user has access to the PID of the event and if not, enqueue an
-     * access denied flash message and redirect to list view
+     * access denied flash message
      */
-    public function checkEventAccess(Event $event): void
+    public function checkEventAccess(Event $event): bool
     {
         if ($this->getBackendUser()->isInWebMount($event->getPid()) === null) {
             $this->addFlashMessage(
                 $this->getLanguageService()->sL(self::LANG_FILE . 'administration.accessdenied.content'),
                 $this->getLanguageService()->sL(self::LANG_FILE . 'administration.accessdenied.title'),
                 ContextualFeedbackSeverity::ERROR
             );
-
-            $this->redirect('list');
+            return false;
         }
+
+        return true;
     }
 
     /**

@@ -371,15 +371,14 @@ public function notifyActionSendsNotificationsLogsAndRedirects(): void
     /**
      * @test
      */
-    public function checkEventAccessRedirectsToListViewIfNoEventAccess(): void
+    public function checkEventAccessReturnsFalseIfNoEventAccess(): void
     {
         $event = new Event();
 
         $mockBackendUser = $this->getMockBuilder(BackendUserAuthentication::class)->getMock();
         $mockBackendUser->expects(self::once())->method('isInWebMount')->willReturn(null);
         $GLOBALS['BE_USER'] = $mockBackendUser;
 
-        $this->subject->expects(self::once())->method('redirect');
-        $this->subject->checkEventAccess($event);
+        self::assertFalse($this->subject->checkEventAccess($event));
     }
 }