Cancelling own account lets your report yourself

I didn't want users to be able to report themselves either. The culprit is the logic in mollom.module here:

  // Integrate with delete confirmation forms to send feedback to Mollom.
  if (isset($forms['delete'][$form_id])) {
    // Check whether the user is allowed to report to Mollom. Limiting report
    // access is optional for forms integrating via 'delete form' and allowed by
    // default, since we assume that users being able to delete entities are
    // sufficiently trusted to also report to Mollom.
    $access = TRUE;
    // Retrieve information about the protected form; the form cache maps delete
    // confirmation forms to protected form_ids, and protected form_ids to their
    // originating modules.
    $mollom_form_id = $forms['delete'][$form_id];
    $module = $forms['protected'][$mollom_form_id];
    $form_info = mollom_form_info($mollom_form_id, $module);
    // Check access, if there is a 'report access' permission list.
    if (isset($form_info['report access'])) {
      $access = FALSE;
      foreach ($form_info['report access'] as $permission) {
        if (user_access($permission)) {
          $access = TRUE;
          break;
        }
      }
    }
    // Omit reporting form during user cancelation. 
    if ($mollom_form_id == 'user_register_form') $access = FALSE;
    if ($access) {
      mollom_data_delete_form_alter($form, $form_state);
      // Report before deleting. This needs to be handled here, since
      // mollom_data_delete_form_alter() is re-used for mass-operation forms.
      array_unshift($form['#submit'], 'mollom_data_delete_form_submit');
    }
  }

The "Omit reporting..." and subsequent line are not part of the original code.

Note that the assumption is that the user has the right to see the Report as Inappropriate form, mentioned in the first comment. It looked to me that to change that required that the User Cancelation form show up as part of the form configuration list (mollom_form_list) and that some logic be added to allow turning the reporting form off. I don't have a patch (sorry) but the line I added above ( if ($mollom_form_id == ...) ) is doing the job for me until a better mechanism is implemented.

subscribing

Nice work aangel. This makes sense and works nicely as a fix. I attached patch for 7.x-1.x branch.

Well obviously those tests will fail since this patch wants to prevent those actions in those situations... :)

This is an extreme edge-case, and I doubt that it's worth to cater for it.

Specifically, I don't see what's ultimately wrong with having the Mollom feedback options in the confirmation form when you're canceling your own account.

The options only appear if you are able to moderate (administer) users in the first place. That's certainly a very small minority of all users on a site, and additionally, those users (community moderators/administrators) are very unlikely to cancel their own account.

Even if they cancel their own account, there's technically nothing wrong with allowing them report themselves as inappropriate... Of course, doing so will negatively affect their own reputation across Mollom-protected sites. But is it wrong? Not really.

In the end, I don't see sufficient reasons for introducing code and complexity to account for this rare, special case.

You're right. During the test process, I was using an admin account. A normal user won't have access to this reporting option anyways.

@troybthompson: That bug has been fixed in 2.x already and will be part of the upcoming stable release.

And apparently, you're right. :) Attached patch proves in a test that this is indeed bogus.

Attached patch fixes the issue.

Thanks for reporting, reviewing, and testing! Committed to 7.x-2.x.

A new development snapshot will be available within the next 12 hours. This improvement will be available in the next official release.

This needs to be backported to 6.x-2.x, but that... won't be so easy.

Backported to D6.

Committed to 6.x-2.x.