I found this bug on both Website Payments Standard and Express Checkout methods.
If a customer chooses to pay via Paypal, he enters in PayPal's pages. If he changes his mind he can press "cancel and return to website" link to return back.
What if then he uses the "previous arrow" of his browser to return to PayPal? He can still pay for the previous order, even if he has modified his cart in the meanwhile.
This is a video explaining the bug (customer discomfort): https://drive.google.com/file/d/0B7GTXoOzbPUXOEYyZlAwdm5od3M/view?usp=sharing
Also, Magento's previous order was put in "canceled" status, all items have been void and returned to stock. The automatically generated invoice (if the customer at last pays) has no reference to the items and they cannot be shipped. The order, after "canceled" status, returns to "processing" but nothing can be done.
I read PayPal's API documentation and it is stated that "cancel_return" url cancels the payment. I had a long conversation with PayPal developer's support. This is their last answer:
As per understanding that we've got from the video, most probably the bug is from the shopping cart that you are currently using which is Magento. We understand that this might cause a hassle to the customer and as the standard logic in PayPal, PayPal is considered everything sent over to the server will be processed if and only if the order or the request did not have any problem such without any price or valid email of the merchant.
Is this a known bug? I could reproduce this behavior from Magento version 188.8.131.52 to 184.108.40.206, with both PayPal Standard and PayPal Pro, except direct card payment. How can this be solved, except by changing the payment method?