What causes "Bad link. Bad value for parameter hashp" in Dolibarr/dolibarr?

Pass the real ecm file hash: get it from the file's EcmFiles record (hashp column) or dol_buildHashic-based generation

Bad link. Bad value for parameter hashp

Error message

Bad link. Bad value for parameter hashp

What it means

viewimage.php explicitly rejects the literal hashp value 'shared' with 400 'Bad link. Bad value for parameter hashp'. 'shared' is a reserved/sentinel value, not a real ecm file hash, so a request carrying it is treated as a malformed link.

Solutions

Pass the real ecm file hash: get it from the file's EcmFiles record (hashp column) or dol_buildHashic-based generation
Check why your code produced the placeholder 'shared' instead of the computed hash
Regenerate the share link from the UI or via getFileLink()/ecmfile->hashp
If you don't use shared links, drop hashp and use modulepart+file instead

Example fix

// before
$url = DOL_URL_ROOT.'/viewimage.php?hashp=shared';
// after
$ecmfile->fetch(0, '', $fullpath);
$url = DOL_URL_ROOT.'/viewimage.php?hashp='.urlencode($ecmfile->hashp);

Defensive patterns

Strategy: validation

Validate before calling

if ($hashp === 'shared' || empty($hashp)) { throw new InvalidArgumentException('hashp must be a real ecm hash'); }

Type guard

function isValidHashp(?string $h): bool { return $h !== null && $h !== '' && $h !== 'shared' && preg_match('/^[a-zA-Z0-9]+$/', $h) === 1; }

Prevention

Always compute hashp from the EcmFiles record; never hard-code placeholders
Check for share-generation failures before emitting links
Treat 'shared' as a reserved word; do not use it as a hash value in your own code
Validate links in staging before distributing them

When it happens

Trigger: GET viewimage.php?hashp=shared — usually because code that resolves a shared hash failed and left the placeholder 'shared' in the URL, or a template hard-codes hashp=shared.

Common situations: Public share features whose hash generation failed; code copying the share URL pattern but substituting the placeholder instead of the real hash; users hand-editing shared links.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/3e5429c920b1ddc0. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/viewimage.php:183

require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';

$action = GETPOST('action', 'aZ09');
$original_file = GETPOST('file', 'alphanohtml');
$hashp = GETPOST('hashp', 'aZ09', 1);
$extname = GETPOST('extname', 'alpha', 1);
$modulepart = GETPOST('modulepart', 'alpha', 1);
$urlsource = GETPOST('urlsource', 'alpha');
$entity = ($entity > 0 ? $entity : $conf->entity);

// Security check
if (empty($modulepart) && empty($hashp)) {
	httponly_accessforbidden('Bad link. Bad value for parameter modulepart', 400);
}
if (empty($original_file) && empty($hashp) && $modulepart != 'barcode') {
	httponly_accessforbidden('Bad link. Missing identification to find file (param file or hashp)', 400);
}
if ($hashp == 'shared') {
	httponly_accessforbidden('Bad link. Bad value for parameter hashp', 400);
}
if ($modulepart == 'fckeditor') {
	$modulepart = 'medias'; // For backward compatibility
}


/*
 * Actions
 */

// None



/*
 * View
 */

View on GitHub (pinned to 598aa4bdad)