Dolibarr/dolibarr · error

ErrorLinkNotFoundWithSharedLink

Error message

ErrorLinkNotFoundWithSharedLink

What it means

When a shared link (hashp) points to an ECM 'links' record (an external URL attached to an object) that no longer exists or is invalid, document.php cannot resolve it, loads the 'errors' language file, and calls httponly_accessforbidden() with the translated ErrorLinkNotFoundWithSharedLink (HTTP 403). The shared hash matched a link-type record but its URL could not be used or the record is gone.

Solutions

1. Re-generate the share link from the document/ECM entry (share tab) and resend it
2. Verify the underlying link record still exists in llx_ecm_files / links table
3. Check the hashp parameter was not truncated by email clients or URL shorteners
4. If the share was intentionally revoked, inform users the link is no longer valid

Example fix

// before (stale link)
document.php?hashp=abc123old
// after (regenerated)
document.php?hashp=<new share hash from ECM share tab>

// check link record exists before sharing
$ecm = new EcmFiles($db);
if ($ecm->fetch(0,'','','',$hashp) <= 0) { warn('shared link target missing'); }

try { $res = $ecmfile->fetch(0,'','','',$hashp); if ($res <= 0) { throw new Exception('shared link not found'); } } catch (Exception $e) { show_friendly_link_expired_page(); }

When it happens

Trigger: document.php?hashp=<hash> where fetch of the EcmFiles/link record by hashp returns no valid entry (or the entry is a link whose URL is empty/deleted) — the else branch fires the 403.

Common situations: Recipients clicking an old share link after the linked record/URL was deleted; truncated or mistyped hashp in the shared URL; share revoked but the link still circulating.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

• ErrorFileNotFoundWithSharedLink
• Access refused to by SQL or Script injection protection in…
• Bad link. Bad value for parameter hashp
• Bad link. File is from another module part.
• Bad link. File is from another module part.

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/537221019cd80611. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/document.php:204

/*
 * View
 */

// If we have a hash public (hashp), we guess the original_file.
$ecmfile = '';
if (!empty($hashp) && $hashp != 'shared') {
	if (GETPOST('type', 'alpha') == 'link') {
		require_once DOL_DOCUMENT_ROOT.'/core/class/link.class.php';
		$link = new Link($db);
		$result = $link->fetch(0, $hashp);
		if ($result > 0 && !empty($link->url)) {
			if (preg_match('/^(http|dav)/', $link->url)) {
				header('Location: '.$link->url);
				exit;
			}
		} else {
			$langs->load("errors");
			httponly_accessforbidden($langs->trans("ErrorLinkNotFoundWithSharedLink"), 403, 1);
		}
	} else {
		include_once DOL_DOCUMENT_ROOT . '/ecm/class/ecmfiles.class.php';
		$ecmfile = new EcmFiles($db);
		$result = $ecmfile->fetch(0, '', '', '', $hashp);
		if ($result > 0) {
			$tmp = explode('/', $ecmfile->filepath, 2); // $ecmfile->filepath is relative to document directory
			// filepath can be 'users/X' or 'X/propale/PR11111'
			if (is_numeric($tmp[0])) { // If first tmp is numeric, it is subdir of company for multicompany, we take next part.
				$tmp = explode('/', $tmp[1], 2);
			}
			$moduleparttocheck = $tmp[0]; // moduleparttocheck is first part of path

			if ($modulepart) {    // Not required, so often not defined, for link using public hashp parameter.
				if ($moduleparttocheck == $modulepart) {
					// We remove first level of directory
					$original_file = (($tmp[1] ? $tmp[1] . '/' : '') . $ecmfile->filename); // this is relative to module dir
					//var_dump($original_file); exit;

View on GitHub (pinned to 598aa4bdad)