{"record":{"id":"af9fe6f635330657","repo":"Dolibarr/dolibarr","slug":"errorfilenotfoundwithsharedlink-viewimage","errorCode":null,"errorMessage":"ErrorFileNotFoundWithSharedLink","messagePattern":"ErrorFileNotFoundWithSharedLink","errorType":"http","errorClass":null,"httpStatus":403,"severity":"warning","filePath":"htdocs/viewimage.php","lineNumber":245,"sourceCode":"\n\t\tif ($modulepart) {\t// Not required, so often not defined, for link using public hashp parameter.\n\t\t\tif ($moduleparttocheck == $modulepart) {\n\t\t\t\t// We remove first level of directory\n\t\t\t\t$original_file = (($tmp[1] ? $tmp[1].'/' : '').$ecmfile->filename); // this is relative to module dir\n\t\t\t\t//var_dump($original_file); exit;\n\t\t\t} else {\n\t\t\t\thttponly_accessforbidden('Bad link. File is from another module part.', 403);\n\t\t\t}\n\t\t} else {\n\t\t\t$modulepart = $moduleparttocheck;\n\t\t\t$original_file = (($tmp[1] ? $tmp[1].'/' : '').$ecmfile->filename); // this is relative to module dir\n\t\t}\n\n\t\tif ($extname) {\n\t\t\t$original_file = getImageFileNameForSize($original_file, $extname);\n\t\t}\n\t} else {\n\t\thttponly_accessforbidden(\"ErrorFileNotFoundWithSharedLink\", 403, 1);\n\t}\n}\n\n// Define mime type\n$type = 'application/octet-stream';\nif (GETPOST('type', 'alpha')) {\n\t$type = GETPOST('type', 'alpha');\n} else {\n\t$type = dol_mimetype($original_file);\n}\n\n// Security: This wrapper is for images. We do not allow type/html\nif (preg_match('/html/i', $type)) {\n\thttponly_accessforbidden('Error: Using the image wrapper to output a file with a mime type HTML is not possible.');\n}\n// Security: This wrapper is for images. We do not allow files ending with .noexe\nif (preg_match('/\\.noexe$/i', $original_file)) {\n\thttponly_accessforbidden('Error: Using the image wrapper to output a file ending with .noexe is not allowed.');","sourceCodeStart":227,"sourceCodeEnd":263,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/viewimage.php#L227-L263","documentation":"When a shared link (hashp) is used, viewimage.php looks up the EcmFiles record and related permissions; if the file referenced by the shared hash cannot be found (or the shared-link branch fails to resolve a file), it calls httponly_accessforbidden('ErrorFileNotFoundWithSharedLink', 403, 1). The message is deliberately generic to avoid leaking file existence.","triggerScenarios":"GET viewimage.php?hashp=<hash> where the hash does not match any llx_ecm_files row (deleted file, wrong hash, expired/rotated share, different entity), causing the $ecmfile fetch/verification inside the hashp branch to fail.","commonSituations":"Recipients opening an old shared link after the file was deleted or moved; database restores losing ecm_files rows; multicompany entity mismatch between share creation and access; truncated hashp values in copied URLs.","solutions":["Regenerate the shared link (recompute hashp from the current file record)","Verify a row exists in llx_ecm_files with that hashp for the correct entity","Recreate the missing ecm_files record if the file exists on disk (ECM module rescan / fix tool)","Check multicompany entity configuration matches where the share was created"],"exampleFix":"// before\n$hashp = substr($knownhash, 0, 16); // truncated\n// after\ninclude_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmfiles.class.php';\n$ecmfile = new EcmFiles($db);\n$ecmfile->fetch(0, '', $relpath);\n$hashp = $ecmfile->hashp;","handlingStrategy":"fallback","validationCode":"$ecmfile = new EcmFiles($db);\nif ($ecmfile->fetch(0, '', '', $hashp) <= 0) { $this->errors[] = 'Shared link invalid'; }","typeGuard":null,"tryCatchPattern":"if ($ecmfile->fetch(0, '', '', $hashp) <= 0) {\n    http_response_code(404);\n    exit('Shared link no longer valid');\n}","preventionTips":["Regenerate share links after file deletions, moves, or DB restores","Verify llx_ecm_files rows survive backup/restore procedures","Check entity consistency when using multicompany with shared links","Copy full hashp values — avoid truncation when sharing URLs"],"tags":["http-403","shared-links","hashp","viewimage","dolibarr"],"backgroundTag":"resource-not-found","analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}