Formerly Entitled - Adminhtml Mass Action Occasionally Fails To Reach Controller

I have an admin module that features a custom grid widget with a few custom mass actions. If I filter the grid, change the size of the grid, or go to a different page the grid will reload via AJAX. All seems serene. But if I then attempt to trigger a mass action, the next thing I see is the dash. After a visit to the dash I'll find that the action failed, the second attempt always succeeds.

To confirm that it wasn't just the action failing I added a die() at the very top of the action.

I'm at a loss.

UPDATE - 11 December

This problem is triggered by AJAX refreshes. It is possible to repeat as soon as an admin session is begun, and the mass action, while not trivial, is not timing out. Additionally this is being tested in a single-user development environment, and so server load is not a concern. I believe that Marius's thought about the form key becoming invalidated is correct. However I have not been able to locate anything to allow me to update the form keys.

I was unable to set the secret key requirement through the admin (I got what looked like a Zend_Debug::dump() die;). After messing directly with the database, I can confirm that the admin's cryptographic nonce is not the source of this problem.

  • 2
    Most probably the form key is not valid anymore. Or it is not sent through POST
    – Marius
    Commented Oct 14, 2013 at 18:49
  • Marius, now that's a thought. The form method is post, so it likely is the form key. I haven't broken the default product grid, so at a guess I would say something is missing from my Grid.php implementation. Commented Oct 15, 2013 at 14:30
  • @RegularlyScheduledProgramming Which version of Magento are you using?
    – Mukesh
    Commented Mar 7, 2016 at 11:03

4 Answers 4


The appropriate solution will be to add proper layout update to the GRID you are facing problem. What you are missing is <update handle="formkey"/> block to GRID layout file.

For eg. In case of sales order GRID xml code will be like below

    <update handle="formkey"/>
    <block type="adminhtml/sales_order_grid" name="sales_order.grid" output="toHtml"></block>

Two options I can think off right now are possible

  1. Your backend session expired or you've already created a new backend session expiring the form key / token in the url. An option would be to disable the key from System > Configuration > Add Secret Key to URLs* or increase the session lifetime from System > Configuration > Session Lifetime (seconds)
  2. The execution time of the mass action took to long caused by to many actions to perform or already having heave traffic on the server causing an execution timeout

*the secret key is there for security reasons and I would advise against disabling it. But for testing purposes it's ok

  • Thanks for the reply Sander, I've updated my question to better represent what I currently understand about the problem and to address your suggestions. Commented Dec 11, 2013 at 16:41

A bit late to the party, but hopefully someone will find this helpful.

I managed to fix a similar problem with this answer: http://magebase.com/magento-tutorials/sales-orders-mass-action-takes-you-back-to-dashboard/ (Copy pasted incase the link goes down)

To fix this issue you can edit app/design/adminhtml/default/default/template/widget/grid/massactions.phtml and change

<?php echo $this->getBlockHtml('formkey')?> 


   <input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" />

I installed "tamper data" extension to firefox. When you submit a mass action, you will notice the first POST won't contain "form_key". The second one will contain it.

In Firebug you can check for example: adminhtml_request_grid_massactionJsObject
Under there you will find "+form" which wont have form_key on the first page load.

  • Changet to: <div><input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" /></div> Commented Feb 18, 2016 at 13:57

A new feature in Magento 1.4.1. is that any filtering done on the Sales > Orders page is now updated via an AJAX call when hitting submit. Unfortunately this has an unindented side-effect: after any ajax updates the mass-actions (Cancel, Hold, Print Invoices, Print Packingslips, etc) will not work. Instead you will be thrown back to the Dashboard (or whatever else your current users start page in the admin area is).

After an ajax update Magento doesn’t load the complete layout of the page. However in the layout it keeps a form key to authenticate the submission of the request. Since this is now missing it will “decline” the request from the mass-action and you are thrown back to the dashboard.

To fix this issue you can edit app/design/adminhtml/default/default/template/widget/grid/massactions.phtml and change

<?php echo $this->getBlockHtml('formkey')?>


<div><input name="form_key" type="hidden" value="<?php echo Mage::getSingleton('core/session')->getFormKey() ?>" /></div>

On a sidenote: after being thrown back to the dashboard and visiting Sales > Orders for a second time it will remember your previous selection. And since it now has done a full page load the mass-action will succeed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.