I know this is a stupid thing to do, but...
Using vanilla 1.5.6c with OPC 2.3.1, php 7.3.17 and PayPal Pro (sandbox activated). I go to checkout, enter CC details and click Confirm Order, give it 3-4 seconds and hit F5 on my keyboard. It takes me back to checkout page (checkout_one) BUT the order actually goes through and is recorded in the admin. If I attempt to go through checkout again, I get a blank screen:
[04-May-2020 21:48:04 UTC] Request URI: /ajax.php?act=ajaxOnePageCheckout&method=updateShipping, IP address: 93.140.231.145
#1 trigger_error() called at [/var/www/vhosts/XYZ/includes/classes/OnePageCheckout.php:956]
#2 OnePageCheckout->setTempShippingToBilling() called at [/var/www/vhosts/XYZ/includes/classes/ajax/zcAjaxOnePageCheckout.php:56]
#3 zcAjaxOnePageCheckout->updateShipping() called at [/var/www/vhosts/XYZ/ajax.php:85]
--> PHP Fatal error: Invalid access; $_SESSION['billto'] is not set. in /var/www/vhosts/XYZ/includes/classes/OnePageCheckout.php on line 956.
The same action actually allows you to go through checkout again in OPC 2.2.0 (duplicate order) and I'm really glad to see it fixed, however... Is it possible to completely block any and all customer interaction while processing checkout? Ideally, block their mouse, keyboard and (F it) even their washing machine in the basement... The only thing that would be allowed is to flip the power switch... :D