theonedev/onedev · error · UnauthorizedException

No permission to edit field: ${fieldName}

Error message

No permission to edit field: ${fieldName}

What it means

After resolving the field spec, getFieldValues checks SecurityUtils.canEditIssueField(subject, project, fieldName) and throws UnauthorizedException 'No permission to edit field: <name>' when the subject lacks edit rights on that particular issue field.

Source

Thrown at server-core/src/main/java/io/onedev/server/model/support/issue/field/FieldUtils.java:231

				values = null;
			if (fieldMap.put(field.getName(), values) != null)
				throw new ValidationException("Duplicate field: " + field.getName());
		}
		validateFieldMap(fieldSpecs, fieldMap);
	}

	@SuppressWarnings("unchecked")
	public static Map<String, Object> getFieldValues(Subject subject, Project project, Map<String, Serializable> fieldEdits) {
		var settingService = OneDev.getInstance(SettingService.class);
		var issueSetting = settingService.getIssueSetting();
		Map<String, Object> fieldValues = new HashMap<>();
		for (Map.Entry<String, Serializable> entry : fieldEdits.entrySet()) {
			var fieldName = entry.getKey();
			var fieldSpec = issueSetting.getFieldSpec(fieldName);
			if (fieldSpec == null)
				throw new NotAcceptableException("Undefined field: " + fieldName);
			if (!SecurityUtils.canEditIssueField(subject, project, fieldName))
				throw new UnauthorizedException("No permission to edit field: " + fieldName);

			List<String> values = new ArrayList<>();
			if (entry.getValue() instanceof String) {
				values.add((String) entry.getValue());
			} else if (entry.getValue() instanceof Collection) {
				values.addAll((Collection<String>) entry.getValue());
			}
			fieldValues.put(entry.getKey(), fieldSpec.convertToObject(values));
		}
		return fieldValues;
	}

	public static boolean isFieldVisible(Project project, BeanDescriptor beanDescriptor, Serializable fieldBean, String fieldName) {
		String propertyName = getPropertyName(beanDescriptor, fieldName);
		PropertyDescriptor propertyDescriptor = new PropertyDescriptor(fieldBean.getClass(), propertyName);
		return propertyDescriptor.isPropertyVisible(newPropertyHierarchicalContexts(project, beanDescriptor, fieldBean), beanDescriptor);
	}
	

View on GitHub (pinned to d44925c47c)

Solutions

1. Grant the user/role 'Edit field' permission for that field in project security settings
2. Have a privileged account perform the edit
3. Remove the field from the edit payload if the user should not change it

Example fix

// before
edits.put("Estimation", "8h"); // user cannot edit
// after
if (SecurityUtils.canEditIssueField(subject, project, "Estimation")) {
    edits.put("Estimation", "8h");
}

if (!SecurityUtils.canEditIssueField(subject, project, fieldName))
    throw new SecurityException("No permission to edit field: " + fieldName);

try {
    values = FieldUtils.getFieldValues(subject, project, fieldEdits);
} catch (UnauthorizedException e) {
    auditLog.warn("Field edit denied: {}", e.getMessage());
    throw new WebApplicationException(403);
}

When it happens

Trigger: A user (or API token) attempts to edit a field whose edit permission (field-level 'Edit field' authorization) excludes them, e.g. only project admins may edit 'Estimation'.

Common situations: Service accounts missing field edit privileges; users attempting edits through the REST API while the UI hides the field; newly added field authorization not granted to existing roles.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Access denied
• No permission to update issue fields
• Authentication required
• Issue schedule permission required to set own estimated time
• Issue schedule permission required to set iterations

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/268e12db111fb976. Report an issue: GitHub.