theonedev/onedev · error · UnauthorizedException

You are not allowed to perform this operation

Error message

You are not allowed to perform this operation

What it means

BasePage.unauthorized() is called when page initialization determines the current user lacks required permissions. For logged-in users it throws UnauthorizedException with this message; anonymous users are redirected to the login page instead.

Source

Thrown at server-core/src/main/java/io/onedev/server/web/page/base/BasePage.java:530

			throw new RestartResponseAtInterceptPageException(ServerInitPage.class);
	}

	protected boolean isPermitted() {
		return true;
	}

	protected String getRobotsMeta() {
		return "";
	}

	@Nullable
	protected final User getLoginUser() {
		return SecurityUtils.getAuthUser();
	}

	public void unauthorized() {
		if (getLoginUser() != null)
			throw new UnauthorizedException("You are not allowed to perform this operation");
		else
			throw new RestartResponseAtInterceptPageException(LoginPage.class);
	}

	protected String getPageTitle() {
		return "OneDev - Git Server with CI/CD, Kanban, and Packages";
	}

	protected int getPageRefreshInterval() {
		return 0;
	}

	protected Collection<String> getCssClasses() {
		var cssClasses = new HashSet<String>();
		if (WicketUtils.isSubscriptionActive())
			cssClasses.add("enterprise-edition");
		else
			cssClasses.add("community-edition");

View on GitHub (pinned to d44925c47c)

Solutions

1. Ask a project/system administrator to grant the required permission.
2. Log in as a user with the needed role.
3. Verify group memberships and project authorizations in User/Group management.

Example fix

// before: ordinary user opening /project/x/settings
// after: grant 'Administer Project' or log in as an account with that role

// pre-check permission
if (!SecurityUtils.canAccess(project, Permission.READ)) redirectToFallback();

try {
    visitPage();
} catch (UnauthorizedException e) {
    requestAccessOrSwitchAccount();
}

When it happens

Trigger: Accessing a project/resource page whose authorization check (e.g. page's onInitialize access check) fails while a user is authenticated.

Common situations: User without required role (e.g. not project admin) opening an admin/configuration page; group/permission changes removed access; expired session falling back to a lower-privilege user.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Issue schedule permission required to set iterations
• No permission to update issue fields
• No permission to add specified link for specified issues
• No permission to read code of source project:
• No permission to read code of target project:

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/342823909e075f36. Report an issue: GitHub.