MAGETWO-92197: [Backport for 2.2.x] Mass Action Wrong Requests

Author: Oleksandr Gorkun

app/code/Magento/Sales/Controller/Adminhtml/Order/MassCancel.php

@@ -5,10 +5,12 @@
  */
 namespace Magento\Sales\Controller\Adminhtml\Order;
 
+use Magento\Framework\Exception\NotFoundException;
 use Magento\Framework\Model\ResourceModel\Db\Collection\AbstractCollection;
 use Magento\Backend\App\Action\Context;
 use Magento\Ui\Component\MassAction\Filter;
 use Magento\Sales\Model\ResourceModel\Order\CollectionFactory;
+use Magento\Framework\App\Request\Http as HttpRequest;
 
 class MassCancel extends \Magento\Sales\Controller\Adminhtml\Order\AbstractMassAction
 {
@@ -28,6 +30,20 @@ public function __construct(Context $context, Filter $filter, CollectionFactory
         $this->collectionFactory = $collectionFactory;
     }
 
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        /** @var HttpRequest $request */
+        $request = $this->getRequest();
+        if (!$request->isPost()) {
+            throw new NotFoundException(__('Page not found.'));
+        }
+
+        return parent::execute();
+    }
+
     /**
      * Cancel selected orders
      *

app/code/Magento/Sales/Controller/Adminhtml/Order/MassHold.php

@@ -5,11 +5,13 @@
  */
 namespace Magento\Sales\Controller\Adminhtml\Order;
 
+use Magento\Framework\Exception\NotFoundException;
 use Magento\Framework\Model\ResourceModel\Db\Collection\AbstractCollection;
 use Magento\Backend\App\Action\Context;
 use Magento\Ui\Component\MassAction\Filter;
 use Magento\Sales\Model\ResourceModel\Order\CollectionFactory;
 use Magento\Sales\Api\OrderManagementInterface;
+use Magento\Framework\App\Request\Http as HttpRequest;
 
 /**
  * Class MassHold
@@ -43,6 +45,20 @@ public function __construct(
         $this->orderManagement = $orderManagement;
     }
 
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        /** @var HttpRequest $request */
+        $request = $this->getRequest();
+        if (!$request->isPost()) {
+            throw new NotFoundException(__('Page not found.'));
+        }
+
+        return parent::execute();
+    }
+
     /**
      * Hold selected orders
      *

app/code/Magento/Sales/Controller/Adminhtml/Order/MassUnhold.php

@@ -5,11 +5,13 @@
  */
 namespace Magento\Sales\Controller\Adminhtml\Order;
 
+use Magento\Framework\Exception\NotFoundException;
 use Magento\Framework\Model\ResourceModel\Db\Collection\AbstractCollection;
 use Magento\Backend\App\Action\Context;
 use Magento\Ui\Component\MassAction\Filter;
 use Magento\Sales\Model\ResourceModel\Order\CollectionFactory;
 use Magento\Sales\Api\OrderManagementInterface;
+use Magento\Framework\App\Request\Http as HttpRequest;
 
 class MassUnhold extends AbstractMassAction
 {
@@ -42,6 +44,20 @@ public function __construct(
         );
     }
 
+    /**
+     * @inheritDoc
+     */
+    public function execute()
+    {
+        /** @var HttpRequest $request */
+        $request = $this->getRequest();
+        if (!$request->isPost()) {
+            throw new NotFoundException(__('Page not found.'));
+        }
+
+        return parent::execute();
+    }
+
     /**
      * Unhold selected orders
      *