Index: mollom.api.php
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/mollom/mollom.api.php,v
retrieving revision 1.7
diff -u -p -r1.7 mollom.api.php
--- mollom.api.php	9 Oct 2010 23:13:01 -0000	1.7
+++ mollom.api.php	11 Jan 2011 12:46:22 -0000
@@ -243,8 +243,8 @@
  *     Note that forms that specify 'entity' also need to specify 'post_id' in
  *     the 'mapping' (see below).
  *   - report access callback: (optional) A function name to invoke to check
- *     access to Mollom's dedicated "report to Mollom" form, which should return
- *     either TRUE or FALSE (like any other menu "access callback").
+ *     whether the current user is allowed to "report to Mollom", which should
+ *     return either TRUE or FALSE (like menu access callbacks).
  *   - report access: (optional) A list containing user permission strings, from
  *     which the current user needs to have at least one. Should only be used if
  *     no "report access callback" was defined.
Index: mollom.module
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/mollom/mollom.module,v
retrieving revision 1.94
diff -u -p -r1.94 mollom.module
--- mollom.module	3 Nov 2010 14:52:06 -0000	1.94
+++ mollom.module	11 Jan 2011 12:55:31 -0000
@@ -663,10 +663,33 @@ function mollom_form_alter(&$form, &$for
   }
   // Integrate with delete confirmation forms to send feedback to Mollom.
   if (isset($forms['delete'][$form_id])) {
-    mollom_data_delete_form_alter($form, $form_state);
-    // Report before deleting. This needs to be handled here, since
-    // mollom_data_delete_form_alter() is re-used for mass-operation forms.
-    array_unshift($form['#submit'], 'mollom_data_delete_form_submit');
+    // Check whether the user is allowed to report to Mollom. Limiting report
+    // access is optional for forms integrating via 'delete form' and allowed by
+    // default, since we assume that users being able to delete entities are
+    // sufficiently trusted to also report to Mollom.
+    $access = TRUE;
+    // Retrieve the registered form information; the prepared form cache maps
+    // delete confirmation forms to protected form_ids, and protected form_ids
+    // to their originating modules.
+    $mollom_form_id = $forms['delete'][$form_id];
+    $module = $forms['protected'][$mollom_form_id];
+    $form_info = mollom_form_info($mollom_form_id, $module);
+    // Check access, if there is a 'report access' permission list.
+    if (isset($form_info['report access'])) {
+      $access = FALSE;
+      foreach ($form_info['report access'] as $permission) {
+        if (user_access($permission)) {
+          $access = TRUE;
+          break;
+        }
+      }
+    }
+    if ($access) {
+      mollom_data_delete_form_alter($form, $form_state);
+      // Report before deleting. This needs to be handled here, since
+      // mollom_data_delete_form_alter() is re-used for mass-operation forms.
+      array_unshift($form['#submit'], 'mollom_data_delete_form_submit');
+    }
   }
 }