Version: nopcommerce 2.0
SQL: 2008
Modifications: some but I didn't modify that behavior
Description: When we require the user to accept the terms of service, the only check (as far as I can tell) is in javascript on the shopping cart page. If someone changes the browser url to http://<site>/checkout, he/she can complete the checkout without explcitely accepting the terms. It can also be done by clicking the "checkout" button in the mini cart partial view.
Expected behavior: the checkout controller should check the formcollection to make sure that the termsofservice field is checked when the order settings specify that the terms must be accepted. If it is not, the user should be redirected to the shoppingcart controller's cart action with a message specifying to accept the terms.
I'll try to implement something later today and post it here.