CB Paid Subscriptions

INVNUM is sent to help prevent duplicate payments, but appears the Paypal account setting shown below can bypass this entirely.

https://www.paypal.com/us/smarthelp/article/how-do-i-avoid-duplicate-transactions-ts1097

Regardless double payment attempt within CBSubs it self needs to be fixed.

Looks like the pay button is causing a double request. One call is made to the POST URL then cancelled then another call is made. This is likely why double payment attempt is happening. If the cancel doesn't happen or the request goes through before the cancel can happen it will cause a double attempt. Since the two attempts are then happening at the same time it's not possible for each other to stop one or the other. The form handling code needs improved to stop doing this.

The form is doing this because it's a submit button and the jQuery bound to it is bound to click event. The submit needs to either be JS based or not; not both.