Dolibarr/dolibarr · error

Bad link. Missing identification to find file…

Error message

Bad link. Missing identification to find file (original_file or hashp)

What it means

document.php requires a way to identify the file: either original_file (path relative to the module's document dir) or hashp (public shared-hash). If both are empty the security check calls httponly_accessforbidden() with this message and HTTP 400.

Solutions

1. Add original_file=<relative path> to the document.php URL
2. Or use hashp=<shared hash> for public share links
3. Ensure the parameter survives any routing/rewrite layer (check for stripped query strings)
4. Verify the generating code includes the file path (e.g. from ecmdocs or the object's last_main_doc)

Example fix

// before
document.php?modulepart=ecm
// after
document.php?modulepart=ecm&original_file=myfile.pdf

if (empty($_GET['original_file']) && empty($_GET['hashp'])) {
  http_response_code(400); exit('original_file or hashp required');
}

When it happens

Trigger: document.php called with a modulepart but neither original_file nor hashp, e.g. document.php?modulepart=facture — the check `empty($original_file) && empty($hashp)` triggers.

Common situations: Links built without the filename; original_file dropped by URL rewriting or sanitization; copy-pasted URLs missing query params; custom code that forgot original_file when modulepart is present.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Bad link. Bad value for parameter modulepart
• Bad link. Bad value for parameter hashp
• Bad value for parameter modulepart
• Bad link. File is from another module part.
• Bad link. Bad value for parameter modulepart

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/e94ab579226f7a55. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/document.php:156

 * @var User $user
 */
require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/images.lib.php';

$encoding = '';
$action = GETPOST('action', 'aZ09');
$original_file = GETPOST('file', 'alphanohtml');
$hashp = GETPOST('hashp', 'aZ09');
$modulepart = GETPOST('modulepart', 'alpha');
$urlsource = GETPOST('urlsource', 'alpha');
$entity = ($entity > 0 ? $entity : $conf->entity);

// Security check
if (empty($modulepart) && empty($hashp)) {
	httponly_accessforbidden('Bad link. Bad value for parameter modulepart', 400);
}
if (empty($original_file) && empty($hashp)) {
	httponly_accessforbidden('Bad link. Missing identification to find file (original_file or hashp)', 400);
}
if ($hashp == 'shared') {
	httponly_accessforbidden('Bad link. Bad value for parameter hashp', 400);
}
if ($modulepart == 'fckeditor') {
	$modulepart = 'medias'; // For backward compatibility
}

$socid = 0;
if ($user->socid > 0) {
	$socid = $user->socid;
}

// For some module part, dir may be privates
if (in_array($modulepart, array('facture_paiement', 'unpaid'))) {
	if (!$user->hasRight('societe', 'client', 'voir')) {
		$original_file = 'private/'.$user->id.'/'.$original_file; // If user has no permission to see all, output dir is specific to user
	}

View on GitHub (pinned to 598aa4bdad)