I have added a new mass action on the sales order grid. It worked flawlessly on all 1.9.x releases up to upgrade from so I suspect this is now broken by the new security features that require me to white list Variables and Blocks.

The following code adds and enables the mass action (order export to SCV).

/app/code/local/Mage/Adminhtml/Block/Sales/Order/Grid.php ..

$this->getMassactionBlock()->addItem('export_selected', array(
             'label'=> Mage::helper('sales')->__('(new) Export to CSV'),
              'url'  =>$this->getUrl('*/*/massExport', array('_current'=>true)),


/app/code/local/Mage/Adminhtml/controllers/Sales/OrderController.php ..

public function massExportAction()
         //$productIds = $this->getRequest()->getParam('product');
         $orderIds = $this->getRequest()->getParam('order_ids');
         if (!is_array($orderIds)) {
             $this->_getSession()->addError($this->__('Please select orders(s).'));
         else {
             //write headers to the csv file
             $content = '"order_number","customer_name","customer_email"';
             try {
                 foreach ($orderIds as $orderId) {
                     $order = Mage::getSingleton('sales/order')->load($orderId);
                     $content .= "\"{$order->getIncrementId()}\",\"{$order->getCustomerName()}\",\"{$order->getCustomerEmail()}\"\r\n";
             } catch (Exception $e) {
             $this->_prepareDownloadResponse('orders-export-'.date('Y-m-d H:i:s').'.csv', $content, 'text/csv');



As of calling the function from the Sales Order Grid in the admin interface results in no file being created and 404 that points to frontend..

Any recommendations on what am I missing here?

2 Answers 2


Did you check your var/log/exceptions.log and var/log/system.log for any helpful error message from Magento? Furthermore did you make sure that the block you get via getMassactionBlock() is whitelisted?

From to there was no major security fix that would cause such an impact as far as I remember.

Another question is if the 404 occurs when calling the massAction or the redirects?

  • I would whitelist it, but what is the block name/identifier for this specific block to white list?
    – Cninroh
    Commented May 8, 2016 at 21:01
  • If it is a problem with not whitelisted blocks you would be able to see that in the logs - even the name/identifier to whitelist. Are you sure the 404 happens when calling the massExportAction and not the redirect?
    – codedge
    Commented May 8, 2016 at 21:09
  • This error reporting is enabled in logs, and I have white listed other blocks in this way. It does not create a whitelist entry in the logs for this action, so it seems not to be a whitelist issue.
    – Cninroh
    Commented May 10, 2016 at 4:53

First of all,

Magento core controllers classes cannot be override from local codePool with Mage NamespSace(/app/code/local/Mage/).

You need to override at proper way.

Please follow the below link

Override a controller in Adminhtml

How can I extend/override admin controller for login?

Magento override Adminhtml Customer Controller

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.