netSEO Withdrawal and Return Button for CS-Cart - Order Withdrawal Request Module with Customer Form, Guest OTP and Admin Panel

netSEO: Withdrawal and return button for CS-Cart

netSEO: Withdrawal and Return Button is a professional addon for CS-Cart that allows customers to request withdrawal from the contract or return products directly from the store, in accordance with modern e-commerce practices. The module offers a form for authenticated customers, OTP verification flow for guests, full management in the admin (and in the vendor panel for Multi-Vendor), native CS-Cart email notifications and configurable eligibility rules (period, order status, quantities).

Withdrawal button in the customer's account

Logged-in customers can initiate a request directly from the order details:

• Button visible only for eligible orders (status, period, returnable products)
• Link to the dedicated netseo_withdrawal.request form
• Configurable button text from settings or language variable
• Validate command ownership and active addon license

The flow is natively integrated into the order details page, without any changes to the core CS-Cart files.

Authenticated customer form

The request form includes all the data necessary for processing:

• Selection of products and returned quantities (partial return configurable)
• Reason for request, customer comments, IBAN for refund
• Configurable legal text (HTML) displayed on the form
• CSRF protection and anti-double-submission token
• Unique request code (format RET-AN-NNNNNN) and success confirmation page

Upon saving, confirmation emails are automatically sent to the client, admin notification and (in Multi-Vendor) vendor notification.

Guest form with OTP verification

For customers without an account, the module offers a secure public feed:

• Guest public page (dispatch or configurable SEO URL, e.g. retragere-comanda )
• Order identification by order number + email or phone number
• Send OTP code via email (dedicated template), configurable expiration and attempt limit
• Generic messages on failed identification (anti-enumeration) and rate limiting
• After OTP verification: display of the order and the possibility to continue the request

OTPs are stored hash-wise ( password_hash ), with invalidation upon expiration or exceeding the maximum number of attempts.

Configurable eligibility rules

The administrator controls when the button appears and when requests are accepted:

• Withdrawal period – number of days from order completion (default 14)
• Eligible order statuses – e.g. only "Complete" (C), multiple selection
• Partial return – enabled/disabled; quantities per product line
• Block products already included in an active request (Open status)
• Validate quantities: cannot exceed the remaining returnable quantity

Admin panel – request management

In the backend, the Orders → Withdrawal / Return Requests menu offers:

• Paginated list with filters: status, order, email, phone, date range
• Request details: customer data, order, products, reason, IBAN, admin comments
• Change status: Open, Canceled, Completed
• Complete history of statuses (who, when, comment)
• Snapshot data vendor (Multi-Vendor) at the time of request

Multi-Vendor – separate requests per vendor

In CS-Cart Multi-Vendor, the module correctly manages orders with products from multiple vendors:

• A separate request per company_id on submit
• The vendor only sees their own requests in the vendor panel ( runtime.company_id filter)
• Dedicated vendor menu: Orders → Withdrawal / return requests
• The vendor can change the status of their own requests and add comments
• Email to customer upon status change, with Reply-To to vendor email
• Marketplace admin sees all requests from all vendors

Email notifications (CS-Cart native system)

All emails use CS-Cart templates (Documents → Email templates), editable from the admin:

• request_created – client confirmation on new request
• guest_otp – verification code for guest flow
• status_open , status_cancelled , status_completed – when changing status
• admin_new_request – marketplace administrator alert
• vendor_new_request – vendor alert (Multi-Vendor)

Sending via Tygh::$app['mailer'] , with standard variables (request code, order, products, vendor data) and Reply-To configured where applicable.

Security and integritygiven data

The module includes protection measures for sensitive flows:

• InnoDB transactions on save request, with FOR UPDATE on the command
• Verify admin/vendor access per company_id
• CSRF on forms, session ID regeneration after valid OTP
• Throttle for guest identification and OTP rate limit per order
• Dedicated tables: requests, product lines, status history, OTPs

Add-on settings

Configuration from the CS-Cart admin panel (separate sections):

• License (netSEO license code)
• General: period, guest form, dispatch/SEO URL, eligible statuses, partial return
• OTP: expiration (minutes), maximum number of attempts
• Notifications: admin email, send email on status change
• Storefront: public button text, legal form text

License, Addons Manager and updates

The module depends on netSEO Addons Manager :

• License verification upon activation and periodically in the backend
• License code configured from the addon settings
• Upgrade Center Connector for automatic updates (api.cs-cart.ro)
• Behavior aligned with other netSEO addons

Compatibility

The addon is built for stability and scalability:

• Compatible with CS-Cart 4.10.1+ , ULTIMATE and MULTIVENDOR editions
• Required dependency: netSEO Addons Manager
• Romanian translations via .po file; no hardcoded texts in PHP/template
• Clean uninstall: removes the addon tables from the database

Native integration in CS-Cart

netSEO: Withdrawal and return button integrates into the storefront (order button, customer and guest forms, success page), into the admin (Orders menu, list and details of requests, email templates) and into the Multi-Vendor vendor panel (list, details, status change). Without such a module, withdrawal requests are managed manually (email, phone, spreadsheets), with the risk of losing requests, lack of traceability and difficulties in complying with legal withdrawal deadlines. This addon centralizes the process: from the button in the customer account or the public guest form, to the management in the admin and automatic notifications, including Multi-Vendor scenarios with separate requests per supplier.