{"record":{"id":"13a7ff046b4d7079","repo":"OrchardCMS/OrchardCore","slug":"not-authorized-to-delete-this-content","errorCode":null,"errorMessage":"Not authorized to delete this content","messagePattern":"Not authorized to delete this content","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/OrchardCore.Modules/OrchardCore.Lists/RemotePublishing/MetaWeblogHandler.cs","lineNumber":451,"sourceCode":"        }\n\n        return true;\n    }\n\n    private async Task<bool> MetaWeblogDeletePostAsync(\n        string contentItemId,\n        string userName,\n        string password,\n        IEnumerable<IXmlRpcDriver> drivers)\n    {\n        var user = await ValidateUserAsync(userName, password);\n\n        var contentItem = (await _contentManager.GetAsync(contentItemId, VersionOptions.Latest))\n            ?? throw new InvalidOperationException(\"Could not find content item \" + contentItemId);\n\n        if (!await _authorizationService.AuthorizeAsync(user, CommonPermissions.DeleteContent, contentItem))\n        {\n            throw new InvalidOperationException(S[\"Not authorized to delete this content\"].Value);\n        }\n\n        foreach (var driver in drivers)\n        {\n            driver.Process(contentItem.ContentItemId);\n        }\n\n        await _contentManager.RemoveAsync(contentItem);\n        return true;\n    }\n\n    private async Task<ClaimsPrincipal> ValidateUserAsync(string userName, string password)\n    {\n        if (!await _membershipService.CheckPasswordAsync(userName, password))\n        {\n            throw new InvalidOperationException(S[\"The username or e-mail or password provided is incorrect.\"].Value);\n        }\n","sourceCodeStart":433,"sourceCodeEnd":469,"githubUrl":"https://github.com/OrchardCMS/OrchardCore/blob/4306c0717fe573f6fca1b4955909ddab6a192807/src/OrchardCore.Modules/OrchardCore.Lists/RemotePublishing/MetaWeblogHandler.cs#L433-L469","documentation":"MetaWeblogHandler's delete-post path fetches the latest version of the content item and then requires the user to pass CommonPermissions.DeleteContent authorization for that specific item. If the check fails, an InvalidOperationException with this message is thrown, aborting the delete. It is a deliberate authorization guard, not a bug.","triggerScenarios":"Calling the MetaWeblog 'blogger.deletePost' XML-RPC API with credentials of a user who lacks DeleteContent permission on the target content item. Note CheckAccessAsync (error 372) can also surface the same message text for other verbs.","commonSituations":"Remote blogging clients (e.g. OpenLiveWriter) configured with an account whose role is author/contributor without delete rights; deleted or archived items where the latest version owner differs; misconfigured roles in a multi-tenant site.","solutions":["Grant the user's role the 'Delete Content' permission (or EditContent of own items per site policy) in Admin > Security > Roles.","Use an account with sufficient privileges in the remote blogging client.","If deletion is not intended for that role, have the client skip delete and use edit instead.","Handle the InvalidOperationException in your XML-RPC client and surface a clear permission message."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Check the user's role grants DeleteContent before calling blogger.deletePost\nvar hasDelete = await authorizationService.AuthorizeAsync(user, CommonPermissions.DeleteContent, contentItem);\nif (!hasDelete) throw new UnauthorizedAccessException(\"User cannot delete this content item.\");","typeGuard":null,"tryCatchPattern":"try { await metaWeblog.DeletePostAsync(appKey, postId, userName, password, publish); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"Not authorized\"))\n{ /* surface a permission-denied message or re-authenticate with a privileged account */ }","preventionTips":["Audit role permissions before wiring remote publishing clients.","Use a dedicated account with the minimal required content permissions.","Catch and translate MetaWeblog InvalidOperationExceptions in the XML-RPC client UI.","Re-test client credentials after any role or tenant permission change."],"tags":["authorization","xml-rpc","metaweblog"],"backgroundTag":"permission-denied","analyzedSha":"4306c0717fe573f6fca1b4955909ddab6a192807","analyzedAt":"2026-09-13T17:41:05.024Z","contentChangedAt":"2026-09-13T17:41:05.024Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}