{"record":{"id":"c6f42c3acd0d3e83","repo":"Dolibarr/dolibarr","slug":"bad-link-bad-value-for-parameter-hashp","errorCode":null,"errorMessage":"Bad link. Bad value for parameter hashp","messagePattern":"Bad link\\. Bad value for parameter hashp","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"htdocs/document.php","lineNumber":159,"sourceCode":"require_once DOL_DOCUMENT_ROOT.'/core/lib/images.lib.php';\n\n$encoding = '';\n$action = GETPOST('action', 'aZ09');\n$original_file = GETPOST('file', 'alphanohtml');\n$hashp = GETPOST('hashp', 'aZ09');\n$modulepart = GETPOST('modulepart', 'alpha');\n$urlsource = GETPOST('urlsource', 'alpha');\n$entity = ($entity > 0 ? $entity : $conf->entity);\n\n// Security check\nif (empty($modulepart) && empty($hashp)) {\n\thttponly_accessforbidden('Bad link. Bad value for parameter modulepart', 400);\n}\nif (empty($original_file) && empty($hashp)) {\n\thttponly_accessforbidden('Bad link. Missing identification to find file (original_file or hashp)', 400);\n}\nif ($hashp == 'shared') {\n\thttponly_accessforbidden('Bad link. Bad value for parameter hashp', 400);\n}\nif ($modulepart == 'fckeditor') {\n\t$modulepart = 'medias'; // For backward compatibility\n}\n\n$socid = 0;\nif ($user->socid > 0) {\n\t$socid = $user->socid;\n}\n\n// For some module part, dir may be privates\nif (in_array($modulepart, array('facture_paiement', 'unpaid'))) {\n\tif (!$user->hasRight('societe', 'client', 'voir')) {\n\t\t$original_file = 'private/'.$user->id.'/'.$original_file; // If user has no permission to see all, output dir is specific to user\n\t}\n}\n\n","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/document.php#L141-L177","documentation":"To prevent leaking files via guessed or forged public hashes, document.php rejects the literal value hashp='shared' with HTTP 400 via httponly_accessforbidden(). A real shared link hash is a long random string; 'shared' is a placeholder, not a valid hash.","triggerScenarios":"Accessing document.php with hashp=shared in the query string — the check `if ($hashp == 'shared')` fires and access is forbidden with HTTP 400.","commonSituations":"Copy-pasting incomplete share links where the real hash was replaced/lost; templates with a literal 'shared' placeholder not substituted; documentation examples used verbatim.","solutions":["Use the real share hash generated by Dolibarr (ECM share tab / share links), not the literal 'shared'","Re-generate the public share link from the document's Share page","Fix templates that print 'shared' as an unsubstituted placeholder","Remove hashp and use modulepart+original_file for authenticated downloads"],"exampleFix":"// before\nhref=\"document.php?hashp=shared\"\n// after\nhref=\"document.php?hashp=<?php echo $ecmfile->share; ?>\"","handlingStrategy":"validation","validationCode":"if (isset($_GET['hashp']) && ($_GET['hashp'] === '' || $_GET['hashp'] === 'shared')) {\n  http_response_code(400); exit('hashp must be the generated share hash');\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Substitute real share hashes in templates; never ship literal 'shared'","Regenerate links from the ECM share tab","Reject placeholder values in link-building code","Keep share hashes intact in emails (avoid line-wrapping)"],"tags":["http-400","share-link","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}