Possible annoying multiply posts when browser disconnected in process and server answer lost

[tgely]

If customer's browser disconnect between checkout process then possible to do more orders with refresh browser page and post again values.
This could be issue on more processes where post forms used because $sessiontoken never reset before redirections.

$sessiontoken never be examined (and if not set before) in checkout_process.php so possible to run more and more.

oscommerce2/catalog/checkout_confirmation.php

Line 116 in de0e97d

echo HTML::form('checkout_confirmation', $form_action_url, 'post');

oscommerce2/catalog/checkout_process.php

Lines 345 to 351 in de0e97d

	unset($_SESSION['sendto']);
	unset($_SESSION['billto']);
	unset($_SESSION['shipping']);
	unset($_SESSION['payment']);
	unset($_SESSION['comments']);
	OSCOM::redirect('checkout_success.php');

You could say that admin be able to delete multiply orders but some system stock sensitive so this issue prevent product offers until admin do an action.

Advice to reset $sessiontoken after process and before redirections and use $sessiontoken more widely.