If you renew a patron's registration by using the 'Renew' link that is displayed after the expiration warning on the checkout screen, and you click said link more than once, the dateexpiry gets changed and extended a requisite number of times. In other words, if your enrollment period is two years and you double-click this link, the new expiration date will be end up being four years from today. If you triple click it, it will be 6 years. Quadruple click it for 8 years. (It's not possible to do this using the dropdown renewal option as it produces a dialogue box asking for the user to confirm the registration renewal.) To replicate: 1.) Create or select a patron category that has an enrollment period that is calculated in months (not a fixed date, for this example I use 24 months 2.) Find or create a patron in that category with an expired account 3.) Open this patron's account for checkout and find the warning about the patron's expired account 4.) Double click 'Renew' 5.) When the page reloads confirm that the expiration date is now 48 months from today (rather than the 24 dictated by the category enrollment period)
This may be related to bug 15792.
Would a confirm message with the new date work here? I think sometimes it might be wanted to be able to renew multiple times, so not sure we should block this totally. Maybe just needs a security question.
When you renew from the patron menu, we have a confirmation alert, but when you click the renew link on an already expired account there is no alert. In both cases the page reloads and shows the new exiration date in a message box.