{"record":{"id":"268e12db111fb976","repo":"theonedev/onedev","slug":"no-permission-to-edit-field-fieldname","errorCode":null,"errorMessage":"No permission to edit field: ${fieldName}","messagePattern":"No permission to edit field: (.+?)","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":401,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/model/support/issue/field/FieldUtils.java","lineNumber":231,"sourceCode":"\t\t\t\tvalues = null;\n\t\t\tif (fieldMap.put(field.getName(), values) != null)\n\t\t\t\tthrow new ValidationException(\"Duplicate field: \" + field.getName());\n\t\t}\n\t\tvalidateFieldMap(fieldSpecs, fieldMap);\n\t}\n\n\t@SuppressWarnings(\"unchecked\")\n\tpublic static Map<String, Object> getFieldValues(Subject subject, Project project, Map<String, Serializable> fieldEdits) {\n\t\tvar settingService = OneDev.getInstance(SettingService.class);\n\t\tvar issueSetting = settingService.getIssueSetting();\n\t\tMap<String, Object> fieldValues = new HashMap<>();\n\t\tfor (Map.Entry<String, Serializable> entry : fieldEdits.entrySet()) {\n\t\t\tvar fieldName = entry.getKey();\n\t\t\tvar fieldSpec = issueSetting.getFieldSpec(fieldName);\n\t\t\tif (fieldSpec == null)\n\t\t\t\tthrow new NotAcceptableException(\"Undefined field: \" + fieldName);\n\t\t\tif (!SecurityUtils.canEditIssueField(subject, project, fieldName))\n\t\t\t\tthrow new UnauthorizedException(\"No permission to edit field: \" + fieldName);\n\n\t\t\tList<String> values = new ArrayList<>();\n\t\t\tif (entry.getValue() instanceof String) {\n\t\t\t\tvalues.add((String) entry.getValue());\n\t\t\t} else if (entry.getValue() instanceof Collection) {\n\t\t\t\tvalues.addAll((Collection<String>) entry.getValue());\n\t\t\t}\n\t\t\tfieldValues.put(entry.getKey(), fieldSpec.convertToObject(values));\n\t\t}\n\t\treturn fieldValues;\n\t}\n\n\tpublic static boolean isFieldVisible(Project project, BeanDescriptor beanDescriptor, Serializable fieldBean, String fieldName) {\n\t\tString propertyName = getPropertyName(beanDescriptor, fieldName);\n\t\tPropertyDescriptor propertyDescriptor = new PropertyDescriptor(fieldBean.getClass(), propertyName);\n\t\treturn propertyDescriptor.isPropertyVisible(newPropertyHierarchicalContexts(project, beanDescriptor, fieldBean), beanDescriptor);\n\t}\n\t","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/model/support/issue/field/FieldUtils.java#L213-L249","documentation":"After resolving the field spec, getFieldValues checks SecurityUtils.canEditIssueField(subject, project, fieldName) and throws UnauthorizedException 'No permission to edit field: <name>' when the subject lacks edit rights on that particular issue field.","triggerScenarios":"A user (or API token) attempts to edit a field whose edit permission (field-level 'Edit field' authorization) excludes them, e.g. only project admins may edit 'Estimation'.","commonSituations":"Service accounts missing field edit privileges; users attempting edits through the REST API while the UI hides the field; newly added field authorization not granted to existing roles.","solutions":["Grant the user/role 'Edit field' permission for that field in project security settings","Have a privileged account perform the edit","Remove the field from the edit payload if the user should not change it"],"exampleFix":"// before\nedits.put(\"Estimation\", \"8h\"); // user cannot edit\n// after\nif (SecurityUtils.canEditIssueField(subject, project, \"Estimation\")) {\n    edits.put(\"Estimation\", \"8h\");\n}","handlingStrategy":"try-catch","validationCode":"if (!SecurityUtils.canEditIssueField(subject, project, fieldName))\n    throw new SecurityException(\"No permission to edit field: \" + fieldName);","typeGuard":null,"tryCatchPattern":"try {\n    values = FieldUtils.getFieldValues(subject, project, fieldEdits);\n} catch (UnauthorizedException e) {\n    auditLog.warn(\"Field edit denied: {}\", e.getMessage());\n    throw new WebApplicationException(403);\n}","preventionTips":["Grant service accounts the required field-edit authorizations","Check canEditIssueField per field before including it in edits","Keep UI hiding of fields consistent with server-side permissions"],"tags":["security","permissions","issue-fields"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}