theonedev/onedev · error · UnauthorizedActionException

Component ENABLE not authorized

Error message

Component ENABLE not authorized

What it means

Thrown as UnauthorizedActionException when a call that would enable/update a component (via the model set path in Component.java) fails isActionAuthorized(ENABLE). Wicket's authorization mechanism (IAuthorizationStrategy) can veto the ENABLE action per component, and the framework converts that veto into an exception rather than silently skipping the update.

Source

Thrown at server-core/src/main/java/org/apache/wicket/Component.java:3139

	 */
	@SuppressWarnings("unchecked")
	public final Component setDefaultModelObject(final Object object)
	{
		final IModel<Object> model = (IModel<Object>)getDefaultModel();

		// Check whether anything can be set at all
		if (model == null)
		{
			throw new IllegalStateException(
				"Attempt to set a model object on a component without a model! " +
				"Either pass an IModel to the constructor or use #setDefaultModel(new SomeModel(object)). " +
				"Component: " + getPageRelativePath());
		}

		// Check authorization
		if (!isActionAuthorized(ENABLE))
		{
			throw new UnauthorizedActionException(this, ENABLE);
		}

		// Check whether this will result in an actual change
		if (!getModelComparator().compare(this, object))
		{
			modelChanging();
			model.setObject(object);
			modelChanged();
		}

		return this;
	}

	/**
	 * Sets whether or not component will output id attribute into the markup. id attribute will be
	 * set to the value returned from {@link Component#getMarkupId()}.
	 * 
	 * @param output

View on GitHub (pinned to d44925c47c)

Solutions

1. Check your IAuthorizationStrategy#isActionAuthorized implementation and allow Component.ENABLE for this component.
2. If the component is meant to be read-only, do not call setModelObject on it; update the model object directly instead of through the component.
3. Review authorization annotations/meta-data registered for the component class or page.

Example fix

// before
public boolean isActionAuthorized(Component c, Action action) {
    return !action.getName().equals(Component.ENABLE); // blocks everything
}
// after
public boolean isActionAuthorized(Component c, Action action) {
    if (Component.ENABLE.equals(action.getName()) && isEditable(c)) {
        return true;
    }
    return super.isActionAuthorized(c, action);
}

boolean allowed = Session.get().getAuthorizationStrategy().isActionAuthorized(component, Component.ENABLE);

try { component.setModelObject(value); } catch (UnauthorizedActionException e) { // component is protected; update model object directly instead }

When it happens

Trigger: An IAuthorizationStrategy (or meta-data annotation-based strategy) denies action Component.ENABLE for the component while code calls setModelObject/setDefaultModelObject on it.

Common situations: Applications that restrict editing via authorization strategies; components in read-only pages where ENABLE was disallowed; security configs accidentally applying Component.ENABLE denial to form controls.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Access denied
• Unauthorized groovy script:
• Permission denied
• Permission denied
• Unauthorized

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/86d9c7a3f2685e77. Report an issue: GitHub.