{"record":{"id":"81f35fcb8209ebb6","repo":"Dolibarr/dolibarr","slug":"param-dbt-keyfield-is-required-but-not-defined","errorCode":null,"errorMessage":"Param dbt_keyfield is required but not defined","messagePattern":"Param dbt_keyfield is required but not defined","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"htdocs/core/lib/security.lib.php","lineNumber":1002,"sourceCode":"\t\t\t\t\treturn false;\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t$sharedelement = 'project'; // for multicompany compatibility\n\t\t\t\t$sql = \"SELECT COUNT(dbt.\".$db->sanitize($dbt_select).\") as nb\";\n\t\t\t\t$sql .= \" FROM \".MAIN_DB_PREFIX.$dbtablename.\" as dbt\";\n\t\t\t\t$sql .= \" WHERE dbt.\".$db->sanitize($dbt_select).\" IN (\".$db->sanitize($objectid, 1).\")\";\n\t\t\t\t$sql .= \" AND dbt.entity IN (\".getEntity($sharedelement, 1).\")\";\n\t\t\t}\n\n\t\t\t$checkonentitydone = 1;\n\t\t}\n\t\t//var_dump($sql);\n\n\t\tif (!$checkonentitydone && !in_array($feature, $nocheck) && !empty($objectid)) {\t\t// By default (case of $checkdefault), we check on object entity + link to third party on field $dbt_keyfield\n\t\t\t// If external user: Check permission for external users\n\t\t\tif ($user->socid > 0) {\n\t\t\t\tif (empty($dbt_keyfield)) {\n\t\t\t\t\tdol_print_error(null, 'Param dbt_keyfield is required but not defined');\n\t\t\t\t}\n\t\t\t\t$sql = \"SELECT COUNT(dbt.\".$db->sanitize($dbt_keyfield).\") as nb\";\n\t\t\t\t$sql .= \" FROM \".MAIN_DB_PREFIX.$dbtablename.\" as dbt\";\n\t\t\t\t$sql .= \" WHERE dbt.rowid IN (\".$db->sanitize($objectid, 1).\")\";\n\t\t\t\t$sql .= \" AND dbt.\".$db->sanitize($dbt_keyfield).\" = \".((int) $user->socid);\n\t\t\t} elseif (isModEnabled(\"societe\") && !$user->hasRight('societe', 'client', 'voir')) {\n\t\t\t\t// If internal user without permission to see all thirdparties: Check permission for internal users that are restricted on their objects\n\t\t\t\tif (empty($dbt_keyfield)) {\n\t\t\t\t\tdol_print_error(null, 'Param dbt_keyfield is required but not defined');\n\t\t\t\t}\n\t\t\t\tif ($feature != 'ticket') {\n\t\t\t\t\t$sql = \"SELECT COUNT(sc.fk_soc) as nb\";\n\t\t\t\t\t$sql .= \" FROM \".MAIN_DB_PREFIX.$db->sanitize($dbtablename).\" as dbt\";\n\t\t\t\t\t$sql .= \", \".MAIN_DB_PREFIX.\"societe_commerciaux as sc\";\n\t\t\t\t\t$sql .= \" WHERE dbt.\".$db->sanitize($dbt_select).\" IN (\".$db->sanitize($objectid, 1).\")\";\n\t\t\t\t\t$sql .= \" AND dbt.entity IN (\".getEntity($sharedelement, 1).\")\";\n\t\t\t\t\t$sql .= \" AND sc.fk_soc = dbt.\".$db->sanitize($dbt_keyfield);\n\t\t\t\t\t$sql .= \" AND (sc.fk_user = \".((int) $user->id);","sourceCodeStart":984,"sourceCodeEnd":1020,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/core/lib/security.lib.php#L984-L1020","documentation":"Inside checkUserAccessToObject's entity/multicompany check, when the feature requires scoping by a shared key field the caller must supply $dbt_keyfield (the column on $dbtablename used to test ownership/sharing, e.g. fk_soc). It was empty, so the security SQL cannot be built and access checking fails closed.","triggerScenarios":"Thrown at htdocs/core/lib/security.lib.php:1002 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass the correct dbt_keyfield (e.g. 'fk_soc' or the object's foreign-key column) when calling _checkAccessToResource/checkUserAccessToObject","If the table has no such key field, pass a feature listed in $nocheck or adjust the caller to skip that check legitimately","Verify the caller (create, deleteById, getByValues, deleteByValues, getDocumentsListByElement) forwards the key field parameter","Check the module's access() method: it usually hardcodes the right dbt_keyfield per feature"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}