backend controller, magento routes to start page when already logged in as admin

Question

i have a question about magento routeing. i have created a test module with config.xml file like this:

<admin>
        <routers>
            <adminhtml>
                <args>
                    <modules>
                        <foo before="Mage_Adminhtml">MyCompany_MyModule_Adminhtml</foo>
                    </modules>
                </args>
            </adminhtml>
        </routers>
    </admin>

and action controller like this: class

MyCompany_MyModule_Adminhtml_CustomController extends
Mage_Adminhtml_Controller_Action{
public function indexAction()
    {
       echo "works";
    }

}

and when i type in url section this link: http://mymagentosite.com/index.php/admin/custom/indexit asks me admin name and password, i type it correctly and it goes to blank page with "works" echoed. But if i am already loged in as administrator it just automaticaly goes to admin start page: http://mymagentosite.com/index.php/admin/dashboard/index/key/dd5f.. why this is happening? why i cant go to this empty page when i am already loged in as admin?

Answer 1

When you are logged in can call the page http://mymagentosite.com/index.php/admin/custom/index you get redirected to the dashboard because your secret key is missing. Notice that all the urls in the backend have a parameter called key, that is autogenerated depending on the controller and action name and some random string that is stored in the session.

If you disable this security feature (from system->configuration->admin) you will be able to call your desired url and it will work this time, but you expose yourself to attack.