{"record":{"id":"86d9c7a3f2685e77","repo":"theonedev/onedev","slug":"component-enable-not-authorized","errorCode":null,"errorMessage":"Component ENABLE not authorized","messagePattern":"Component ENABLE not authorized","errorType":"exception","errorClass":"UnauthorizedActionException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/org/apache/wicket/Component.java","lineNumber":3139,"sourceCode":"\t */\n\t@SuppressWarnings(\"unchecked\")\n\tpublic final Component setDefaultModelObject(final Object object)\n\t{\n\t\tfinal IModel<Object> model = (IModel<Object>)getDefaultModel();\n\n\t\t// Check whether anything can be set at all\n\t\tif (model == null)\n\t\t{\n\t\t\tthrow new IllegalStateException(\n\t\t\t\t\"Attempt to set a model object on a component without a model! \" +\n\t\t\t\t\"Either pass an IModel to the constructor or use #setDefaultModel(new SomeModel(object)). \" +\n\t\t\t\t\"Component: \" + getPageRelativePath());\n\t\t}\n\n\t\t// Check authorization\n\t\tif (!isActionAuthorized(ENABLE))\n\t\t{\n\t\t\tthrow new UnauthorizedActionException(this, ENABLE);\n\t\t}\n\n\t\t// Check whether this will result in an actual change\n\t\tif (!getModelComparator().compare(this, object))\n\t\t{\n\t\t\tmodelChanging();\n\t\t\tmodel.setObject(object);\n\t\t\tmodelChanged();\n\t\t}\n\n\t\treturn this;\n\t}\n\n\t/**\n\t * Sets whether or not component will output id attribute into the markup. id attribute will be\n\t * set to the value returned from {@link Component#getMarkupId()}.\n\t * \n\t * @param output","sourceCodeStart":3121,"sourceCodeEnd":3157,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/org/apache/wicket/Component.java#L3121-L3157","documentation":"Thrown as UnauthorizedActionException when a call that would enable/update a component (via the model set path in Component.java) fails isActionAuthorized(ENABLE). Wicket's authorization mechanism (IAuthorizationStrategy) can veto the ENABLE action per component, and the framework converts that veto into an exception rather than silently skipping the update.","triggerScenarios":"An IAuthorizationStrategy (or meta-data annotation-based strategy) denies action Component.ENABLE for the component while code calls setModelObject/setDefaultModelObject on it.","commonSituations":"Applications that restrict editing via authorization strategies; components in read-only pages where ENABLE was disallowed; security configs accidentally applying Component.ENABLE denial to form controls.","solutions":["Check your IAuthorizationStrategy#isActionAuthorized implementation and allow Component.ENABLE for this component.","If the component is meant to be read-only, do not call setModelObject on it; update the model object directly instead of through the component.","Review authorization annotations/meta-data registered for the component class or page."],"exampleFix":"// before\npublic boolean isActionAuthorized(Component c, Action action) {\n    return !action.getName().equals(Component.ENABLE); // blocks everything\n}\n// after\npublic boolean isActionAuthorized(Component c, Action action) {\n    if (Component.ENABLE.equals(action.getName()) && isEditable(c)) {\n        return true;\n    }\n    return super.isActionAuthorized(c, action);\n}","handlingStrategy":"try-catch","validationCode":"boolean allowed = Session.get().getAuthorizationStrategy().isActionAuthorized(component, Component.ENABLE);","typeGuard":null,"tryCatchPattern":"try { component.setModelObject(value); } catch (UnauthorizedActionException e) { // component is protected; update model object directly instead }","preventionTips":["Keep IAuthorizationStrategy ENABLE rules in sync with components that are programmatically updated.","Use component.setEnabled(false) and visibility checks rather than denying ENABLE when only display is intended.","Test pages with the authorization strategy enabled in CI."],"tags":["wicket","authorization","security","component"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}