{"record":{"id":"4f972a79242a5e52","repo":"theonedev/onedev","slug":"permission-denied","errorCode":null,"errorMessage":"Permission denied","messagePattern":"Permission denied","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"warning","filePath":"server-core/src/main/java/io/onedev/server/web/page/project/issues/boards/BacklogColumnPanel.java","lineNumber":166,"sourceCode":"\t\t\tadd(new WebMarkupContainer(\"showProgress\").setVisible(false));\n\t\t}\n\t\t\n\t\tif (getQuery() != null) {\n\t\t\tPageParameters params = ProjectIssueListPage.paramsOf(getProject(), getQuery().toString(), 0);\n\t\t\tadd(new BookmarkablePageLink<Void>(\"viewAsList\", ProjectIssueListPage.class, params));\n\t\t} else {\n\t\t\tadd(new WebMarkupContainer(\"viewAsList\").setVisible(false));\n\t\t}\n\t\t\n\t\tadd(countLabel = new Label(\"count\", countModel).setOutputMarkupId(true));\n\t\t\n\t\tadd(ajaxBehavior = new AbstractPostAjaxBehavior() {\n\t\t\t\n\t\t\t@Override\n\t\t\tprotected void respond(AjaxRequestTarget target) {\n\t\t\t\tvar subject = SecurityUtils.getSubject();\n\t\t\t\tif (!canManageIssues(subject, getProject()))\n\t\t\t\t\tthrow new UnauthorizedException(_T(\"Permission denied\"));\n\t\t\t\t\n\t\t\t\tIRequestParameters params = RequestCycle.get().getRequest().getPostParameters();\n\t\t\t\tvar issueId = params.getParameterValue(\"issueId\").toLong();\n\t\t\t\tvar cardIndex = params.getParameterValue(\"cardIndex\").toInt();\n\t\t\t\t\n\t\t\t\tvar card = cardListPanel.findCard(issueId);\n\t\t\t\tif (card == null) { // moved from other columns\n\t\t\t\t\tvar issue = getIssueService().load(issueId);\n\t\t\t\t\tvar user = SecurityUtils.getUser(subject);\n\t\t\t\t\tfor (var iteration: getProject().getHierarchyIterations()) {\n\t\t\t\t\t\tif (getIterationPrefix() == null || iteration.getName().startsWith(getIterationPrefix()))\n\t\t\t\t\t\t\tgetIssueChangeService().removeSchedule(user, issue, iteration);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tcardListPanel.onCardDropped(target, issueId, cardIndex, true);\n\t\t\t}\n\t\t\t\n\t\t});","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/web/page/project/issues/boards/BacklogColumnPanel.java#L148-L184","documentation":"BacklogColumnPanel's AJAX behavior (drag/drop of issue cards on the issue board) re-checks authorization server-side on every request: if the current subject cannot manage issues in the project (SecurityUtils.canManageIssues), it throws UnauthorizedException('Permission denied'). Client-side drag affordances are cosmetic; the server enforces the real rule.","triggerScenarios":"POSTing the board's AJAX callback (moving/dropping an issue card in the backlog column) while logged in as a user without 'Manage Issues' / board-editing permission on that project.","commonSituations":"Non-admin users dragging cards on a board where they have read-only access; session switched to a lower-privilege user while a board page stays open; API/script replaying board AJAX calls.","solutions":["Grant the user role/permission 'Manage Issues' (or appropriate issue-board editing permission) in Project -> Access/Authorization.","Log in as a user with issue-management rights before reordering board cards.","If users should only reorder their own issues, adjust the board/issue permission setup rather than bypassing the check."],"exampleFix":"// before (server logs)\nUnauthorizedException: Permission denied\n// after (admin action)\nProject -> Authorization -> add role with 'Manage issues' permission for the user/group","handlingStrategy":"try-catch","validationCode":"// client-side pre-check before issuing the AJAX move\nboolean canManage = OneDev.getInstance(Session.class) /* or UI check */ != null && SecurityUtils.canManageIssues(SecurityUtils.getSubject(), project);\nif (!canManage) alert(\"You need 'Manage Issues' permission to reorder board cards\");","typeGuard":null,"tryCatchPattern":"onAjaxError: function(err) {\n  if (err.message.includes('Permission denied')) {\n    showNotice('You lack permission to manage issues in this project.');\n  }\n}","preventionTips":["Grant 'Manage Issues' permission to users expected to work the board.","Re-login after role changes so the subject picks up new permissions.","Hide drag/drop affordances for read-only users."],"tags":["onedev","security","authorization","ajax"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}