Local Fonts module allows 'deleting' non-local fonts, with potentially disastrous results

Which submodules were enabled?

I could not quite reproduce this; got a different sort of abnormal behavior though:

Notice: Undefined index: path in local_fonts_delete_font() (line 412 of /var/www/fyf/sites/default/modules/fontyourface/modules/local_fonts/local_fonts.module).
Warning: scandir(): Directory name cannot be empty in local_fonts_delete_font() (line 416 of /var/www/fyf/sites/default/modules/fontyourface/modules/local_fonts/local_fonts.module).
Warning: Invalid argument supplied for foreach() in local_fonts_delete_font() (line 418 of /var/www/fyf/sites/default/modules/fontyourface/modules/local_fonts/local_fonts.module).
Warning: rmdir(): No such file or directory in local_fonts_delete_font() (line 428 of /var/www/fyf/sites/default/modules/fontyourface/modules/local_fonts/local_fonts.module).

(trying to delete a Typekit font; obviously, Local Fonts module should not interfere here)

I more or less figured this out. 'Delete font record' belongs to Local Fonts module (and only local fonts are meant to be deleted this way); however, the button is displayed for all fonts, and trying to delete a Google font can lead to files in the root folder being deleted:

Warning: unlink(./.htaccess): Permission denied in local_fonts_delete_font() (line 421 of /var/www/fyf/sites/default/modules/fontyourface/modules/local_fonts/local_fonts.module).
Warning: unlink(./CHANGELOG.txt): Permission denied in local_fonts_delete_font() (line 421 of /var/www/fyf/sites/default/modules/fontyourface/modules/local_fonts/local_fonts.module).

(my sandbox fortunately had better configured file permissions :)

This is a problem with Local Fonts module, looking into it.

Patch attached.

Display 'Delete font record' button only for local fonts; double-check for font provider in local_fonts_delete_font() function.

Wow, that's a pretty huge bug. kervi, thanks for the report and I hope that didn't cause too much trouble for you. Drave Robber, thanks for the quick patch.

Fix committed.

Oops, missed status change.