5.x-1.9 (obsolete!): Unpublished comments being sent to non-moderators

Hi,
re: http://drupal.org/node/263415

I can confirm that unpublished comments do get sent to non-moderator subscribers.

To reproduce issue:

1. Remove "post comments without approval" permission for anonymous users.
2. Log-in as "test user" with no "administer comments" perm.
3. Subscribe to a node (thread)
4. Log out and post comment to that node as anonymous user
   • Post correctly shows that comment was sent to approval queue;
   • Comment does not show on website for users without "administer comment" perm.
5. Log in as admin
   • check your watchdog log: subscription notification for "test user" <test@driftwoodcove.ca>
   • check your comment approval queue - the comment will be there, as it should.

In every case, the notification message appears in the log - both for my tests and for real users who are subscribed to nodes that got spammed. In some test cases I ran, the log showed that subscription notification was sent, but the e-mail never arrived - perhaps spam filter at e-mail host blocked it? However, the e-mail did arrive in other cases, and did arrive in following case when an actual spammer posted. Here's a sample log entry (with my actual e-mail obscured):

Type	subscriptions
Date	Friday, May 30, 2008 - 11:18am
User	Anonymous
Location	http://lasqueti.ca/comment/reply/231
Referrer	
Message	subscription notification for "test" <test@driftwoodcove.ca>
Severity	notice
Hostname	88.114.47.92

My Subscriptions settings are:

• OFF - Notify poster of own posts
• OFF - Use cron for notifications
• ON - Display watchdog entries for successful mailings
• OFF - Test held posts prior to sending
• ON - Show Subscriptions users menu under "My account"
• OFF - Set all users to "autosubscribe" by default
• ON - Show subscribe link with teaser

I have looked a little through the subscriptions module. The only place where I spot the "administer comments" perm being used to add the "COMMENT_PUBLISHED" criteria to a query is in subscriptions_comment_page - this is only to get the right page for the comment, and the query only applies if there is a comment pager (i.e, the test is not invoked when the comment is on page 0). I can't see any other logic that would block e-mail from being sent for unpublished comments, but I'm only just learning Drupal, so take with grain of salt ;-)

Given that the watchdog message is only submitted after drupal_mail returns success in subscriptions_sendmail, I am pretty confident that this is not working as intended. I am not set-up here for debugging PHP, but if I can assist in tracking this done further, please let me know. Thank you for your help with this :-)