{"record":{"id":"3e5429c920b1ddc0","repo":"Dolibarr/dolibarr","slug":"bad-link-bad-value-for-parameter-hashp-viewimage","errorCode":null,"errorMessage":"Bad link. Bad value for parameter hashp","messagePattern":"Bad link\\. Bad value for parameter hashp","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"htdocs/viewimage.php","lineNumber":183,"sourceCode":"require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';\n\n$action = GETPOST('action', 'aZ09');\n$original_file = GETPOST('file', 'alphanohtml');\n$hashp = GETPOST('hashp', 'aZ09', 1);\n$extname = GETPOST('extname', 'alpha', 1);\n$modulepart = GETPOST('modulepart', 'alpha', 1);\n$urlsource = GETPOST('urlsource', 'alpha');\n$entity = ($entity > 0 ? $entity : $conf->entity);\n\n// Security check\nif (empty($modulepart) && empty($hashp)) {\n\thttponly_accessforbidden('Bad link. Bad value for parameter modulepart', 400);\n}\nif (empty($original_file) && empty($hashp) && $modulepart != 'barcode') {\n\thttponly_accessforbidden('Bad link. Missing identification to find file (param file or hashp)', 400);\n}\nif ($hashp == 'shared') {\n\thttponly_accessforbidden('Bad link. Bad value for parameter hashp', 400);\n}\nif ($modulepart == 'fckeditor') {\n\t$modulepart = 'medias'; // For backward compatibility\n}\n\n\n/*\n * Actions\n */\n\n// None\n\n\n\n/*\n * View\n */\n","sourceCodeStart":165,"sourceCodeEnd":201,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/viewimage.php#L165-L201","documentation":"viewimage.php explicitly rejects the literal hashp value 'shared' with 400 'Bad link. Bad value for parameter hashp'. 'shared' is a reserved/sentinel value, not a real ecm file hash, so a request carrying it is treated as a malformed link.","triggerScenarios":"GET viewimage.php?hashp=shared — usually because code that resolves a shared hash failed and left the placeholder 'shared' in the URL, or a template hard-codes hashp=shared.","commonSituations":"Public share features whose hash generation failed; code copying the share URL pattern but substituting the placeholder instead of the real hash; users hand-editing shared links.","solutions":["Pass the real ecm file hash: get it from the file's EcmFiles record (hashp column) or dol_buildHashic-based generation","Check why your code produced the placeholder 'shared' instead of the computed hash","Regenerate the share link from the UI or via getFileLink()/ecmfile->hashp","If you don't use shared links, drop hashp and use modulepart+file instead"],"exampleFix":"// before\n$url = DOL_URL_ROOT.'/viewimage.php?hashp=shared';\n// after\n$ecmfile->fetch(0, '', $fullpath);\n$url = DOL_URL_ROOT.'/viewimage.php?hashp='.urlencode($ecmfile->hashp);","handlingStrategy":"validation","validationCode":"if ($hashp === 'shared' || empty($hashp)) { throw new InvalidArgumentException('hashp must be a real ecm hash'); }","typeGuard":"function isValidHashp(?string $h): bool { return $h !== null && $h !== '' && $h !== 'shared' && preg_match('/^[a-zA-Z0-9]+$/', $h) === 1; }","tryCatchPattern":null,"preventionTips":["Always compute hashp from the EcmFiles record; never hard-code placeholders","Check for share-generation failures before emitting links","Treat 'shared' as a reserved word; do not use it as a hash value in your own code","Validate links in staging before distributing them"],"tags":["http-400","viewimage","invalid-parameter","shared-links","dolibarr"],"backgroundTag":"invalid-argument-value","analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}