From c84a604949edd213c6cfa08972bcf9cc04c318e8 Mon Sep 17 00:00:00 2001
From: stephensanchez <steve@edx.org>
Date: Tue, 16 Dec 2014 16:37:23 +0000
Subject: [PATCH] Positive filtering which steps can be skipped.

---
 .../verify_student/tests/test_views.py        | 24 +++++++++++++++++++
 lms/djangoapps/verify_student/views.py        |  9 ++++++-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/lms/djangoapps/verify_student/tests/test_views.py b/lms/djangoapps/verify_student/tests/test_views.py
index ee24767cb6..d800eeb773 100644
--- a/lms/djangoapps/verify_student/tests/test_views.py
+++ b/lms/djangoapps/verify_student/tests/test_views.py
@@ -1241,6 +1241,30 @@ class TestPayAndVerifyView(UrlResetMixin, ModuleStoreTestCase):
             PayAndVerifyView.FACE_PHOTO_STEP,
         )
 
+    def test_payment_cannot_skip(self):
+        """
+         Simple test to verify that certain steps cannot be skipped. This test sets up
+         a scenario where the user should be on the MAKE_PAYMENT_STEP, but is trying to
+         skip it. Despite setting the parameter, the current step should still be
+         MAKE_PAYMENT_STEP.
+        """
+        course = self._create_course("verified")
+        response = self._get_page(
+            'verify_student_start_flow',
+            course.id,
+            skip_first_step=True
+        )
+
+        self._assert_messaging(response, PayAndVerifyView.FIRST_TIME_VERIFY_MSG)
+
+        # Expect that *all* steps are displayed,
+        # but we start on the first verify step
+        self._assert_steps_displayed(
+            response,
+            PayAndVerifyView.PAYMENT_STEPS + PayAndVerifyView.VERIFICATION_STEPS,
+            PayAndVerifyView.MAKE_PAYMENT_STEP,
+        )
+
     def test_payment_confirmation_already_verified(self):
         course = self._create_course("verified")
         self._enroll(course.id, "verified")
diff --git a/lms/djangoapps/verify_student/views.py b/lms/djangoapps/verify_student/views.py
index e07c329b36..9ee2060bec 100644
--- a/lms/djangoapps/verify_student/views.py
+++ b/lms/djangoapps/verify_student/views.py
@@ -259,6 +259,12 @@ class PayAndVerifyView(View):
         ENROLLMENT_CONFIRMATION_STEP
     ]
 
+    # These are steps that can be skipped, since there are no barring requirements.
+    SKIP_STEPS = [
+        INTRO_STEP,
+        PAYMENT_CONFIRMATION_STEP
+    ]
+
     Step = namedtuple(
         'Step',
         [
@@ -458,7 +464,8 @@ class PayAndVerifyView(View):
         # Allow the caller to skip the first page
         # This is useful if we want the user to be able to
         # use the "back" button to return to the previous step.
-        if request.GET.get('skip-first-step'):
+        # This parameter should only work for known skip-able steps
+        if request.GET.get('skip-first-step') and current_step in self.SKIP_STEPS:
             display_step_names = [step['name'] for step in display_steps]
             current_step_idx = display_step_names.index(current_step)
             if (current_step_idx + 1) < len(display_steps):