{"record":{"id":"911bdb08a442fd57","repo":"theonedev/onedev","slug":"permission-denied-911bdb","errorCode":null,"errorMessage":"Permission denied","messagePattern":"Permission denied","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"warning","filePath":"server-core/src/main/java/io/onedev/server/web/page/project/issues/boards/BoardColumnPanel.java","lineNumber":366,"sourceCode":"\t\t\t@Override\n\t\t\tprotected void onConfigure() {\n\t\t\t\tsuper.onConfigure();\n\t\t\t\tsetVisible(getQuery() != null \n\t\t\t\t\t\t&& SecurityUtils.getAuthUser() != null\n\t\t\t\t\t\t&& (!getBoard().getIdentifyField().equals(Issue.NAME_STATE) \n\t\t\t\t\t\t\t\t|| getColumn().equals(getIssueSetting().getInitialStateSpec().getName())));\n\t\t\t}\n\t\t\t\n\t\t});\n\t\t\n\t\thead.add(countLabel = new Label(\"count\", countModel).setOutputMarkupId(true));\n\t\t\n\t\tadd(ajaxBehavior = new AbstractPostAjaxBehavior() {\n\n\t\t\t@Override\n\t\t\tprotected void respond(AjaxRequestTarget target) {\n\t\t\t\tif (!canManageIssues(getProject()))\n\t\t\t\t\tthrow new UnauthorizedException(_T(\"Permission denied\"));\n\t\t\t\t\n\t\t\t\tIRequestParameters params = RequestCycle.get().getRequest().getPostParameters();\n\t\t\t\tvar issueId = params.getParameterValue(\"issueId\").toLong();\n\t\t\t\tvar cardIndex = params.getParameterValue(\"cardIndex\").toInt();\n\t\t\t\tvar card = cardListPanel.findCard(issueId);\n\t\t\t\tif (card != null) { // Move in same column\n\t\t\t\t\tcardListPanel.onCardDropped(target, issueId, cardIndex, true);\n\t\t\t\t} else {\n\t\t\t\t\tvar subject = SecurityUtils.getSubject();\n\t\t\t\t\tvar user = SecurityUtils.getUser(subject);\n\t\t\t\t\tIssue issue = getIssueService().load(issueId);\n\t\t\t\t\tString fieldName = getBoard().getIdentifyField();\n\t\t\t\t\tvar iteration = getIterationSelection().getIteration();\n\t\t\t\t\tif (iteration != null && !issue.getIterations().contains(iteration)) {\n\t\t\t\t\t\tgetIssueChangeService().addSchedule(user, issue, iteration);\n\t\t\t\t\t\tcardListPanel.onCardDropped(target, issueId, cardIndex, true);\n\t\t\t\t\t} else if (fieldName.equals(Issue.NAME_STATE)) {\n\t\t\t\t\t\tAtomicReference<ManualSpec> transitionRef = new AtomicReference<>(null);","sourceCodeStart":348,"sourceCodeEnd":384,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/web/page/project/issues/boards/BoardColumnPanel.java#L348-L384","documentation":"BoardColumnPanel's card drag/drop AJAX handler performs the same server-side authorization as the backlog panel: if canManageIssues(getProject()) is false for the current user it throws UnauthorizedException('Permission denied'). The check runs before any issue mutation from the POST parameters.","triggerScenarios":"AJAX card move/drop (issueId/cardIndex POST) on a board column by a user lacking issue-management permission on the project.","commonSituations":"Read-only reporters/viewers attempting to reorder board cards; expired permission after role change while board page remains open; automated clients replaying board requests.","solutions":["Assign the user/group a role with issue-management permission in the project's security settings.","Re-login (or reload the page) after permission changes so the subject picks up new roles.","Verify the board is in a project the user actually has edit rights on; move the board/work to an accessible project otherwise."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if (!SecurityUtils.canManageIssues(project)) { /* disable card drag in UI */ }","typeGuard":null,"tryCatchPattern":"try { /* perform card move */ } catch (UnauthorizedException e) { notifyUser(\"Permission denied: ask for issue-management rights on this project\"); }","preventionTips":["Check project authorization settings for the affected user/group.","Reload the board page after permission updates.","Do not replay board AJAX endpoints from scripts without proper permissions."],"tags":["onedev","security","authorization","ajax"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}