What causes "Bad link. Bad value for parameter modulepart" in Dolibarr/dolibarr?

Add a valid modulepart to the URL (e.g. modulepart=medias, facture, produit, societe)

Bad link. Bad value for parameter modulepart

Error message

Bad link. Bad value for parameter modulepart

What it means

viewimage.php validates its input before serving images: if neither modulepart nor hashp is provided it calls httponly_accessforbidden('Bad link. Bad value for parameter modulepart', 400), producing this plain 400 message. The wrapper cannot locate the image without knowing which module directory to search.

Solutions

Add a valid modulepart to the URL (e.g. modulepart=medias, facture, produit, societe)
For shared/public images, pass the hashp parameter instead of modulepart+file
Fix the PHP/template code that builds the URL so it does not emit an empty modulepart
For barcode images use modulepart=barcode, which is exempt from needing a file param

Example fix

// before
$img = DOL_URL_ROOT.'/viewimage.php?file='.urlencode($rel);
// after
$img = DOL_URL_ROOT.'/viewimage.php?modulepart=medias&file='.urlencode($rel);

Defensive patterns

Strategy: validation

Validate before calling

if (empty($modulepart) && empty($hashp)) { throw new InvalidArgumentException('modulepart or hashp required'); }

Prevention

Never build viewimage URLs with unset/empty variables — check before output
Always include modulepart in image URLs except when using hashp
Use dol_buildImageField / getImageLink helpers instead of hand-built URLs
Use modulepart=barcode only for barcode generation

When it happens

Trigger: GET viewimage.php with an empty or missing modulepart parameter and no hashp parameter, e.g. <img src="/viewimage.php?modulepart=&file=x.png"> or a link where modulepart was lost during URL rewriting.

Common situations: Template code building the image URL with an unset $modulepart variable; URLs generated before modulepart was known; copy-pasted links stripped of parameters; broken custom code omitting modulepart for medias images.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/e75612ed287af8c9. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/viewimage.php:177

 * @var Conf $conf
 * @var DoliDB $db
 * @var HookManager $hookmanager
 * @var Translate $langs
 * @var User $user
 */
require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';

$action = GETPOST('action', 'aZ09');
$original_file = GETPOST('file', 'alphanohtml');
$hashp = GETPOST('hashp', 'aZ09', 1);
$extname = GETPOST('extname', 'alpha', 1);
$modulepart = GETPOST('modulepart', 'alpha', 1);
$urlsource = GETPOST('urlsource', 'alpha');
$entity = ($entity > 0 ? $entity : $conf->entity);

// Security check
if (empty($modulepart) && empty($hashp)) {
	httponly_accessforbidden('Bad link. Bad value for parameter modulepart', 400);
}
if (empty($original_file) && empty($hashp) && $modulepart != 'barcode') {
	httponly_accessforbidden('Bad link. Missing identification to find file (param file or hashp)', 400);
}
if ($hashp == 'shared') {
	httponly_accessforbidden('Bad link. Bad value for parameter hashp', 400);
}
if ($modulepart == 'fckeditor') {
	$modulepart = 'medias'; // For backward compatibility
}


/*
 * Actions
 */

// None

View on GitHub (pinned to 598aa4bdad)