Frustrated by Magento? Then you’ll love
Maybe if I write this down I’ll remember it.
You probably know all Magento admin console URLs need a nonce/key in the URL
http://magento.example.com/admin/catalog_product/edit/id/174/key/c4df66cd2118cb5422c9fb5eff7eq4f0/
That’s why we use the Mage::getModel('adminhtml/url') model object to generate URLs.
What I always forget is any POST to Magento’s backend also needs a form_key variable. Double the CSRF protection. Without this a POST will be redirected to the dashboard. You can generate a form_key with
Mage::getSingleton('core/session')->getFormKey()