Resolved...mostly.
This is what I have found:
+ The problem seems to only occur in Safari (I'm using OSX, can't validate in Windows, but I would imagine the same behavior is present, using the same rendering and execution engine)
+ It seems related to a long-standing communication bug in Safari/OSX that upon a redirect certain header information is missing. The short is that Safari (or some OSX library that Firefox does not use) seems to be the culprit.
+ It appears to be related to apache's keepalive time and when the form is submitted. Quick enough and form submits (under KA time), too long (more than timeout) and the connection resets and the form goes through. But the sweet spot in the middle, apparently that time between the 'keepalive' and 'timeout', causes the form submission to fail.
I withdraw the possibility of any issue that Squirrelcart expressly causes this trouble (though it may still be possible that a workaround that can be coded into SC for form submissions to not use keep alive connections).
What I did to make everything work on my end was to holistically disable keepalive for the index.php file inside the /squirrelcart/ folder with its own htaccess file:
Code:
<FilesMatch "index\.php$">
SetEnv nokeepalive
</FilesMatch>
This may not work for everyone.
(I wrapped in this conditional to focus attention on the problem file and not influence any other files. Though this still does not address the possibility of user-uploaded files failing in similar circumstances. But my situation does not have that possibility, so I am ignoring for now)
Speculation: Depending on the visitor load on one's store, one might be able to set the keepalive time and the timeout to the same value, which might close that hole altogether.
Something I did notice:
In the file: 'squirrelcart/includes/record_form/main.inc.php' on line 14 where the page's form is defined, you assign the form action to the php variable $SC['cart_www_page']. This variable does not appear to exist in this context, leaving the form action blank when editing records. While a blank action does post the page to itself, would it not be better to explicitly define the action to post to itself, either with index.php or a full path the the control panel page?
Additionally, I have always been told that when submit()ing a form it is good practice to include a 'return false;' in the onsubmit property to prevent the form from potentially submitting twice.