In some places the permission to delete patrons is governed by whether or not the user has the "borrowers" permission set: "Add or modify borrowers." In moremember.pl there is a different check governed by a "candeleteuser" variable (line 386): my $candeleteuser; my $userenv = C4::Context->userenv; if($userenv->{flags} % 2 == 1){ $candeleteuser = 1; }elsif ( C4::Context->preference("IndependantBranches") ) { $candeleteuser = ( $data->{'branchcode'} eq $userenv->{branch} ); }else{ if( C4::Auth::getuserflags( $userenv->{flags},$userenv->{number})->{borrowers} ) { $candeleteuser = 1; }else{ $candeleteuser = 0; } } This means that a user viewing a patron record on moremember.pl might have different delete permissions than the same user viewing a patron record in circulation or another patron-related page. A user prevented from deleting by moremember.pl could switch to another page and delete from there.
This bug still exists in master.
This is now fixed, the code is not used anymore. I have submitted a patch on bug 13898 to remove it.