Use the getPageLayout hook which works reliably from Contao 4.4

src/EventListener/PasswordChangeFrontendListener.php

@@ -14,12 +14,11 @@ declare(strict_types=1);
 namespace Terminal42\PasswordValidationBundle\EventListener;
 
 use Contao\CoreBundle\Exception\PageNotFoundException;
+use Contao\CoreBundle\Exception\RedirectResponseException;
 use Contao\CoreBundle\Framework\ContaoFramework;
 use Contao\FrontendUser;
 use Contao\MemberModel;
 use Contao\PageModel;
-use Symfony\Component\HttpFoundation\RedirectResponse;
-use Symfony\Component\HttpKernel\Event\GetResponseEvent;
 use Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolverInterface;
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
 
@@ -41,21 +40,15 @@ final class PasswordChangeFrontendListener
         $this->authenticationTrustResolver = $authenticationTrustResolver;
     }
 
-    public function onKernelRequest(GetResponseEvent $event): void
+    public function onGetPageLayout(PageModel $page): void
     {
         $token = $this->tokenStorage->getToken();
-
         if (null === $token || $this->authenticationTrustResolver->isAnonymous($token)) {
             return;
         }
 
         $this->framework->initialize();
 
-        $page = $GLOBALS['objPage'];
-        if (!$page instanceof PageModel) {
-            return;
-        }
-
         $user = $token->getUser();
         if (!$user instanceof FrontendUser) {
             return;
@@ -65,24 +58,24 @@ final class PasswordChangeFrontendListener
         $adapter  = $this->framework->getAdapter(PageModel::class);
         $rootPage = $adapter->findByPk($page->rootId);
 
-        if ($user->pwChange) {
-            // Search for password-change page
-            $pwChangePage = $adapter->findPublishedById($rootPage->pwChangePage);
-
-            if (!$pwChangePage instanceof PageModel) {
-                throw new PageNotFoundException('No password-change page found.');
-            }
-
-            // Password-change page found, quit
-            if ($page->id === $pwChangePage->id) {
-                return;
-            }
-
-            // Redirect to password-change page
-            $event->setResponse(new RedirectResponse($pwChangePage->getAbsoluteUrl()));
-
+        if (!$user->pwChange) {
             return;
         }
+
+        // Search for password-change page
+        $pwChangePage = $adapter->findPublishedById($rootPage->pwChangePage);
+
+        if (!$pwChangePage instanceof PageModel) {
+            throw new PageNotFoundException('No password-change page found.');
+        }
+
+        // Password-change page found, quit
+        if ($page->id === $pwChangePage->id) {
+            return;
+        }
+
+        // Redirect to password-change page
+        throw new RedirectResponseException($pwChangePage->getAbsoluteUrl());
     }
 
     public function onSetNewPassword($member): void

src/Resources/config/listeners.yml

@@ -35,5 +35,3 @@ services:
       - '@contao.framework'
       - '@security.token_storage'
       - '@security.authentication.trust_resolver'
-    tags:
-      - { name: kernel.event_listener, event: kernel.request, method: onKernelRequest }

src/Resources/contao/config/config.php

@@ -17,6 +17,8 @@ $GLOBALS['TL_HOOKS']['addCustomRegexp'][]   =
     ['terminal42_password_validation.listener.regexp', 'onAddCustomRegexp'];
 $GLOBALS['TL_HOOKS']['setNewPassword'][]    =
     ['terminal42_password_validation.listener.history_log', 'onSetNewPassword'];
+$GLOBALS['TL_HOOKS']['getPageLayout'][] =
+    ['terminal42_password_validation.listener.password_change_frontend', 'onGetPageLayout'];
 $GLOBALS['TL_HOOKS']['setNewPassword'][]    =
     ['terminal42_password_validation.listener.password_change_frontend', 'onSetNewPassword'];
 $GLOBALS['TL_HOOKS']['checkCredentials'][]  =