The 'access' property of hook_user_cancel_methods_alter() methods is never used

Re-rolled patch because previous one didn't apply.

Thanks for working on this. This seems like a useful security improvement. Removing the tag for tests, as there are test cases added already.

There is one thing we should consider and that is, what if a site already has a default method Delete the account and its content. ? This option will be hidden from admin/config/people/accounts after this is committed (because a method with access could not be default) and it can cause problems. Do we need to add an update hook for all such sites to switch the default method for them? I think that probably yes.

Found also a few minor issues:

@@ -81,6 +81,15 @@ function user_form_test_user_account_submit($form, &$form_state) {
   $form_state['rebuild'] = TRUE;
 }
 
+
+/**
+ * Implements hook_user_cancel_methods_alter().

There is an extra newline.

@@ -936,6 +936,42 @@ class UserCancelTestCase extends DrupalWebTestCase {
+    // Create a user with permission to delete user accounts and administer
+    // site configurations.

I would use "administer site configuration" (without s).

@@ -936,6 +936,42 @@ class UserCancelTestCase extends DrupalWebTestCase {
+    $this->assertEqual(count($result), 1, t('Delete the account and make its content belong to the a a user checkbox is checked.'));

There is a typo, I think it should be: "Delete the account and make its content belong to the Anonymous user checkbox is checked.". And I think we do not need to use t() here.

@@ -936,6 +936,42 @@ class UserCancelTestCase extends DrupalWebTestCase {
+    $this->assertNoText('Delete the account and make its content belong to the Anonymous user.', 'Account cancellation methods that have "#access" defined in hook_user_cancel_methods_alter() are not displayed.');
+    $this->assertNoText('Delete the account and its content.', 'Account cancellation methods that have "#access" defined are not displayed.');

It should be: ... that have "access" property defined... (without #)

Anyway, regarding the access to the user_cancel_delete method, this looks same as in D10, so I think we are good here. We will just mention it in a change record and it should be OK.

Thanks!