Update to 1.9.2.4 breaks custom Sales Order Grid mass Action

Question

I have added a new mass action on the sales order grid. It worked flawlessly on all 1.9.x releases up to 1.9.2.4 upgrade from 1.9.2.2 so I suspect this is now broken by the new security features that require me to white list Variables and Blocks.

The following code adds and enables the mass action (order export to SCV).

/app/code/local/Mage/Adminhtml/Block/Sales/Order/Grid.php ..

$this->getMassactionBlock()->addItem('export_selected', array(
             'label'=> Mage::helper('sales')->__('(new) Export to CSV'),
              'url'  =>$this->getUrl('*/*/massExport', array('_current'=>true)),
        ));

..

/app/code/local/Mage/Adminhtml/controllers/Sales/OrderController.php ..

public function massExportAction()
     {
         //$productIds = $this->getRequest()->getParam('product');
         $orderIds = $this->getRequest()->getParam('order_ids');
         if (!is_array($orderIds)) {
             $this->_getSession()->addError($this->__('Please select orders(s).'));
             $this->_redirect('*/*/index');
         }
         else {
             //write headers to the csv file
             $content = '"order_number","customer_name","customer_email"';
             try {
                 foreach ($orderIds as $orderId) {
                     $order = Mage::getSingleton('sales/order')->load($orderId);
                     $content .= "\"{$order->getIncrementId()}\",\"{$order->getCustomerName()}\",\"{$order->getCustomerEmail()}\"\r\n";
                 }
             } catch (Exception $e) {
                 $this->_getSession()->addError($e->getMessage());
                 $this->_redirect('*/*/');
             }
             $this->_prepareDownloadResponse('orders-export-'.date('Y-m-d H:i:s').'.csv', $content, 'text/csv');
         }

     }

..

As of 1.9.2.4 calling the function from the Sales Order Grid in the admin interface results in no file being created and 404 that points to frontend..

Any recommendations on what am I missing here?

Answer 1

Did you check your var/log/exceptions.log and var/log/system.log for any helpful error message from Magento? Furthermore did you make sure that the block you get via getMassactionBlock() is whitelisted?

From 1.9.2.2 to 1.9.2.4 there was no major security fix that would cause such an impact as far as I remember.

Another question is if the 404 occurs when calling the massAction or the redirects?

Answer 2

First of all,

Magento core controllers classes cannot be override from local codePool with Mage NamespSace(/app/code/local/Mage/).

You need to override at proper way.

Please follow the below link

Override a controller in Adminhtml

How can I extend/override admin controller for login?

Magento override Adminhtml Customer Controller