If customer's browser disconnect between checkout process then possible to do more orders with refresh browser page and post again values.
This could be issue on more processes where post forms used because $sessiontoken never reset before redirections.
$sessiontoken never be examined (and if not set before) in checkout_process.php so possible to run more and more.
You could say that admin be able to delete multiply orders but some system stock sensitive so this issue prevent product offers until admin do an action.
Advice to reset $sessiontoken after process and before redirections and use $sessiontoken more widely.
If customer's browser disconnect between checkout process then possible to do more orders with refresh browser page and post again values. This could be issue on more processes where post forms used because $sessiontoken never reset before redirections.
$sessiontoken never be examined (and if not set before) in checkout_process.php so possible to run more and more.
https://github.com/osCommerce/oscommerce2/blob/de0e97d15d43ac6a9a6cfb2847134a82a0148f2b/catalog/checkout_confirmation.php#L116
https://github.com/osCommerce/oscommerce2/blob/de0e97d15d43ac6a9a6cfb2847134a82a0148f2b/catalog/checkout_process.php#L345-L351
You could say that admin be able to delete multiply orders but some system stock sensitive so this issue prevent product offers until admin do an action.
Advice to reset
$sessiontokenafter process and before redirections and use$sessiontokenmore widely.