Dolibarr/dolibarr · error

Param dbt_keyfield is required but not defined

Error message

Param dbt_keyfield is required but not defined

What it means

Inside checkUserAccessToObject's entity/multicompany check, when the feature requires scoping by a shared key field the caller must supply $dbt_keyfield (the column on $dbtablename used to test ownership/sharing, e.g. fk_soc). It was empty, so the security SQL cannot be built and access checking fails closed.

Solutions

1. Pass the correct dbt_keyfield (e.g. 'fk_soc' or the object's foreign-key column) when calling _checkAccessToResource/checkUserAccessToObject
2. If the table has no such key field, pass a feature listed in $nocheck or adjust the caller to skip that check legitimately
3. Verify the caller (create, deleteById, getByValues, deleteByValues, getDocumentsListByElement) forwards the key field parameter
4. Check the module's access() method: it usually hardcodes the right dbt_keyfield per feature

When it happens

Trigger: Thrown at htdocs/core/lib/security.lib.php:1002 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/81f35fcb8209ebb6. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/core/lib/security.lib.php:1002

					return false;
				}
			} else {
				$sharedelement = 'project'; // for multicompany compatibility
				$sql = "SELECT COUNT(dbt.".$db->sanitize($dbt_select).") as nb";
				$sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
				$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
				$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
			}

			$checkonentitydone = 1;
		}
		//var_dump($sql);

		if (!$checkonentitydone && !in_array($feature, $nocheck) && !empty($objectid)) {		// By default (case of $checkdefault), we check on object entity + link to third party on field $dbt_keyfield
			// If external user: Check permission for external users
			if ($user->socid > 0) {
				if (empty($dbt_keyfield)) {
					dol_print_error(null, 'Param dbt_keyfield is required but not defined');
				}
				$sql = "SELECT COUNT(dbt.".$db->sanitize($dbt_keyfield).") as nb";
				$sql .= " FROM ".MAIN_DB_PREFIX.$dbtablename." as dbt";
				$sql .= " WHERE dbt.rowid IN (".$db->sanitize($objectid, 1).")";
				$sql .= " AND dbt.".$db->sanitize($dbt_keyfield)." = ".((int) $user->socid);
			} elseif (isModEnabled("societe") && !$user->hasRight('societe', 'client', 'voir')) {
				// If internal user without permission to see all thirdparties: Check permission for internal users that are restricted on their objects
				if (empty($dbt_keyfield)) {
					dol_print_error(null, 'Param dbt_keyfield is required but not defined');
				}
				if ($feature != 'ticket') {
					$sql = "SELECT COUNT(sc.fk_soc) as nb";
					$sql .= " FROM ".MAIN_DB_PREFIX.$db->sanitize($dbtablename)." as dbt";
					$sql .= ", ".MAIN_DB_PREFIX."societe_commerciaux as sc";
					$sql .= " WHERE dbt.".$db->sanitize($dbt_select)." IN (".$db->sanitize($objectid, 1).")";
					$sql .= " AND dbt.entity IN (".getEntity($sharedelement, 1).")";
					$sql .= " AND sc.fk_soc = dbt.".$db->sanitize($dbt_keyfield);
					$sql .= " AND (sc.fk_user = ".((int) $user->id);

View on GitHub (pinned to 598aa4bdad)