Updated: Comment #0
Problem/Motivation
Locked fields don't show a 'delete field' link in the field ui however the url for the confirm form can still be navigated to via hotlinking (although the submit handler doesn't delete the field).
Proposed resolution
Add an access check for the route to return access denied for locked fields
Remaining tasks
Tests- Fix
User interface changes
None
API changes
None