{"record":{"id":"e75612ed287af8c9","repo":"Dolibarr/dolibarr","slug":"bad-link-bad-value-for-parameter-modulepart-viewimage","errorCode":null,"errorMessage":"Bad link. Bad value for parameter modulepart","messagePattern":"Bad link\\. Bad value for parameter modulepart","errorType":"http","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"htdocs/viewimage.php","lineNumber":177,"sourceCode":" * @var Conf $conf\n * @var DoliDB $db\n * @var HookManager $hookmanager\n * @var Translate $langs\n * @var User $user\n */\nrequire_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';\n\n$action = GETPOST('action', 'aZ09');\n$original_file = GETPOST('file', 'alphanohtml');\n$hashp = GETPOST('hashp', 'aZ09', 1);\n$extname = GETPOST('extname', 'alpha', 1);\n$modulepart = GETPOST('modulepart', 'alpha', 1);\n$urlsource = GETPOST('urlsource', 'alpha');\n$entity = ($entity > 0 ? $entity : $conf->entity);\n\n// Security check\nif (empty($modulepart) && empty($hashp)) {\n\thttponly_accessforbidden('Bad link. Bad value for parameter modulepart', 400);\n}\nif (empty($original_file) && empty($hashp) && $modulepart != 'barcode') {\n\thttponly_accessforbidden('Bad link. Missing identification to find file (param file or hashp)', 400);\n}\nif ($hashp == 'shared') {\n\thttponly_accessforbidden('Bad link. Bad value for parameter hashp', 400);\n}\nif ($modulepart == 'fckeditor') {\n\t$modulepart = 'medias'; // For backward compatibility\n}\n\n\n/*\n * Actions\n */\n\n// None\n","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/Dolibarr/dolibarr/blob/598aa4bdada683d17ca04b1842548821ff0eb6c6/htdocs/viewimage.php#L159-L195","documentation":"viewimage.php validates its input before serving images: if neither modulepart nor hashp is provided it calls httponly_accessforbidden('Bad link. Bad value for parameter modulepart', 400), producing this plain 400 message. The wrapper cannot locate the image without knowing which module directory to search.","triggerScenarios":"GET viewimage.php with an empty or missing modulepart parameter and no hashp parameter, e.g. <img src=\"/viewimage.php?modulepart=&file=x.png\"> or a link where modulepart was lost during URL rewriting.","commonSituations":"Template code building the image URL with an unset $modulepart variable; URLs generated before modulepart was known; copy-pasted links stripped of parameters; broken custom code omitting modulepart for medias images.","solutions":["Add a valid modulepart to the URL (e.g. modulepart=medias, facture, produit, societe)","For shared/public images, pass the hashp parameter instead of modulepart+file","Fix the PHP/template code that builds the URL so it does not emit an empty modulepart","For barcode images use modulepart=barcode, which is exempt from needing a file param"],"exampleFix":"// before\n$img = DOL_URL_ROOT.'/viewimage.php?file='.urlencode($rel);\n// after\n$img = DOL_URL_ROOT.'/viewimage.php?modulepart=medias&file='.urlencode($rel);","handlingStrategy":"validation","validationCode":"if (empty($modulepart) && empty($hashp)) { throw new InvalidArgumentException('modulepart or hashp required'); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never build viewimage URLs with unset/empty variables — check before output","Always include modulepart in image URLs except when using hashp","Use dol_buildImageField / getImageLink helpers instead of hand-built URLs","Use modulepart=barcode only for barcode generation"],"tags":["http-400","viewimage","invalid-parameter","dolibarr"],"backgroundTag":"missing-required-argument","analyzedSha":"598aa4bdada683d17ca04b1842548821ff0eb6c6","analyzedAt":"2026-09-14T11:12:15.309Z","contentChangedAt":"2026-09-14T11:12:15.309Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}