{"record":{"id":"2da5ef4278520ef7","repo":"OrchardCMS/OrchardCore","slug":"not-authorized-to-upload-media","errorCode":null,"errorMessage":"Not authorized to upload media.","messagePattern":"Not authorized to upload media\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/OrchardCore.Modules/OrchardCore.Lists/RemotePublishing/MetaWeblogHandler.cs","lineNumber":180,"sourceCode":"        if (string.IsNullOrWhiteSpace(normalizedPath))\n        {\n            throw new InvalidOperationException(S[\"The media path is invalid.\"].Value);\n        }\n\n        var pathSegments = normalizedPath.Split('/', StringSplitOptions.RemoveEmptyEntries);\n        if (pathSegments.Any(segment => segment is \".\" or \"..\"))\n        {\n            throw new InvalidOperationException(S[\"The media path is invalid.\"].Value);\n        }\n\n        var fileName = pathSegments[^1];\n        var directoryName = string.Join('/', pathSegments[..^1]);\n        var filePath = _mediaFileStore.Combine(directoryName, fileName);\n\n        if (!await _authorizationService.AuthorizeAsync(user, MediaPermissions.ManageMedia)\n            || !await _authorizationService.AuthorizeAsync(user, MediaPermissions.ManageMediaFolder, (object)(directoryName ?? string.Empty)))\n        {\n            throw new InvalidOperationException(S[\"Not authorized to upload media.\"].Value);\n        }\n\n        var extension = Path.GetExtension(filePath);\n        var canUploadRestrictedMedia = await _authorizationService.AuthorizeAsync(\n            user,\n            MediaPermissions.UploadRestrictedMedia);\n        if (!_mediaOptions.AllowedFileExtensions.Contains(extension)\n            && (!canUploadRestrictedMedia\n                || !_mediaOptions.RestrictedFileExtensions.Contains(extension)))\n        {\n            throw new InvalidOperationException(S[\"This file extension is not allowed: {0}\", extension].Value);\n        }\n\n        Stream stream = null;\n        try\n        {\n            stream = new MemoryStream(bits);\n            filePath = await _mediaFileStore.CreateFileFromStreamAsync(","sourceCodeStart":162,"sourceCodeEnd":198,"githubUrl":"https://github.com/OrchardCMS/OrchardCore/blob/4306c0717fe573f6fca1b4955909ddab6a192807/src/OrchardCore.Modules/OrchardCore.Lists/RemotePublishing/MetaWeblogHandler.cs#L162-L198","documentation":"Before writing the uploaded file, the handler authorizes the user against MediaPermissions.ManageMedia and MediaPermissions.ManageMediaFolder for the target directory. If either authorization fails it throws 'Not authorized to upload media.'.","triggerScenarios":"metaWeblog.newMediaObject invoked by an authenticated user whose role lacks ManageMedia permission, or who cannot manage the specific target media folder.","commonSituations":"Blog author accounts without media permissions; uploads targeting a subfolder the role is not allowed to manage (folder-scoped permission); newly created roles missing media feature permissions.","solutions":["Grant the user's role the 'Manage Media' permission in Admin > Security > Roles","Grant folder-level ManageMediaFolder permission for the target directory, or upload to a permitted folder","Verify with a test login that the same user can upload via the Media admin UI"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"var canManage = await authorizationService.AuthorizeAsync(user, MediaPermissions.ManageMedia); var canManageFolder = await authorizationService.AuthorizeAsync(user, MediaPermissions.ManageMediaFolder, directoryName);","typeGuard":null,"tryCatchPattern":"try { await client.NewMediaObjectAsync(blogId, user, pass, media); } catch (InvalidOperationException ex) when (ex.Message == \"Not authorized to upload media.\") { throw new UnauthorizedAccessException(\"Grant the user ManageMedia and folder permissions\", ex); }","preventionTips":["Grant roles the Manage Media permission for users who blog","Check folder-scoped permissions when uploading into subfolders","Verify permissions via the Media admin UI with the same account","Keep blog authors and media-permission grants in sync"],"tags":["xmlrpc","media","authorization","permissions"],"backgroundTag":"permission-denied","analyzedSha":"4306c0717fe573f6fca1b4955909ddab6a192807","analyzedAt":"2026-09-13T17:41:05.024Z","contentChangedAt":"2026-09-13T17:41:05.024Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}