Dolibarr/dolibarr · critical

Value for parameter 'dolibarr_main_url_root' is not defined…

Error message

Value for parameter 'dolibarr_main_url_root' is not defined in your 'htdocs\conf\conf.php' file. You must add this parameter with your full Dolibarr root Url (Example: http://myvirtualdomain/ or http://mydomain/mydolibarrurl/)

What it means

filefunc.inc.php requires dolibarr_main_url_root (the full public root URL of the Dolibarr install) to be set in conf.php unless NOREQUIREVIRTUALURL is defined. When it is empty, Dolibarr prints this instruction with an example URL and dies. Unlike older versions, this parameter is mandatory because it is used to build absolute URLs.

Solutions

1. Add the full root URL to htdocs/conf/conf.php, e.g. $dolibarr_main_url_root='http://mydomain/'; or with subdirectory 'http://mydomain/mydolibarrurl/'.
2. Use the exact externally reachable scheme/host (https, correct port, no trailing slash) so generated links and CSRF checks work.
3. For CLI scripts that legitimately have no virtual URL, define('NOREQUIREVIRTUALURL') before including main.inc.php.
4. After fixing, restart/refresh and verify generated emails/links contain the correct base URL.
5. Complete /install if this conf.php came from an interrupted setup.

Example fix

// before (htdocs/conf/conf.php)
$dolibarr_main_url_root = '';
// after
$dolibarr_main_url_root = 'https://doli.example.com';   // or 'https://doli.example.com/dolibarr'

// fail fast in provisioning when the public URL is missing
$conf = file_get_contents('/var/www/dolibarr/htdocs/conf/conf.php');
if (!preg_match("/\$dolibarr_main_url_root\s*=\s*'https?:\/\/[^']+'/", $conf)) {
    throw new RuntimeException('dolibarr_main_url_root must be set to the full public root URL');
}

function urlRootIsValid(?string $url): bool {
    return is_string($url) && $url !== '' && filter_var($url, FILTER_VALIDATE_URL) !== false
        && str_starts_with($url, 'http');
}

When it happens

Trigger: Any page load with a conf.php that omits or leaves empty $dolibarr_main_url_root, on an entry point that does not define NOREQUIREVIRTUALURL (command-line scripts normally define it, web pages do not).

Common situations: Hand-copied or partially migrated conf.php missing the URL section; fresh install aborted before the URL step; automated provisioning templates that only set DB parameters; hosts migrated to a new domain with the parameter left blank.

Understand the failure class

Background: "missing required config value" errors: why libraries refuse to start when a configuration key is empty, unset, or blank — this error's family across 48 libraries.

Related errors

• Error: Dolibarr config file content seems to be not…
• If define NOREQUIREDB or NOREQUIRETRAN are set, you must…
• If define NOREQUIREUSER is set, you must also set…
• If you access your server behind a proxy using url…
• ErrorConfigParameterNotDefined

AI-assisted analysis of Dolibarr/dolibarr@598aa4bdad (2026-09-14). Data as JSON: /api/errors/61d9dd4780131e38. Report an issue: GitHub.

Appendix: source

Thrown at htdocs/filefunc.inc.php:365

		}
		if ($csrfattack) {
			//print 'NOCSRFCHECK='.defined('NOCSRFCHECK').' REQUEST_METHOD='.$_SERVER['REQUEST_METHOD'].' HTTP_HOST='.$_SERVER['HTTP_HOST'].' HTTP_REFERER='.$_SERVER['HTTP_REFERER'];
			// Note: We can't use dol_escape_htmltag here to escape output because lib functions.lib.ph is not yet loaded.
			dol_syslog("--- Access to ".(empty($_SERVER["REQUEST_METHOD"]) ? '' : $_SERVER["REQUEST_METHOD"].' ').$_SERVER["PHP_SELF"]." refused by CSRF protection (Bad referrer).", LOG_WARNING);
			print "Access refused by CSRF protection in main.inc.php. Referrer of form (".htmlentities(empty($_SERVER['HTTP_REFERER']) ? '' : $_SERVER['HTTP_REFERER'], ENT_COMPAT, 'UTF-8').") is outside the server that serve this page (with method = ".htmlentities($_SERVER['REQUEST_METHOD'], ENT_COMPAT, 'UTF-8').").\n";
			print "If you access your server behind a proxy using url rewriting, you might check that all HTTP headers are propagated (or add the line \$dolibarr_nocsrfcheck=1 into your conf.php file to remove this security check).\n";
			die;
		}
	}
	// Another test is done later on token if option MAIN_SECURITY_CSRF_WITH_TOKEN is on.
}
if (empty($dolibarr_main_db_host) && !defined('NOREQUIREDB')) {
	print '<div class="center">Dolibarr setup is not yet complete.<br><br>'."\n";
	print '<a href="install/index.php">Click here to finish Dolibarr install process</a> ...</div>'."\n";
	die;
}
if (empty($dolibarr_main_url_root) && !defined('NOREQUIREVIRTUALURL')) {
	print 'Value for parameter \'dolibarr_main_url_root\' is not defined in your \'htdocs\conf\conf.php\' file.<br>'."\n";
	print 'You must add this parameter with your full Dolibarr root Url (Example: http://myvirtualdomain/ or http://mydomain/mydolibarrurl/)'."\n";
	die;
}

if (empty($dolibarr_main_url_root_alt)) {
	$dolibarr_main_url_root_alt = '/custom';
}
if (empty($dolibarr_main_document_root_alt)) {
	$dolibarr_main_document_root_alt = $dolibarr_main_document_root.'/custom';
}

if (empty($dolibarr_main_data_root)) {
	// If directory not defined, we use the default hardcoded value
	$dolibarr_main_data_root = str_replace("/htdocs", "", $dolibarr_main_document_root);
	$dolibarr_main_data_root .= "/documents";
}

// Define some constants

View on GitHub (pinned to 598aa4bdad)