Major form improvements:
- Custom SMTP/Sieve credentials (separate username/password per protocol)
- Connection testing on save (IMAP, SMTP, Sieve) with localized errors
- preconfig_only mode to restrict domains to preconfigured entries
- Form POST value preservation on save errors (auth selects, passwords)
- Smart host placeholders (SMTP/Sieve default to IMAP host)
Security and bug:
- Fix password re-encryption bug (was comparing raw vs encrypted values)
- Fix XSS: escape label output in special folders form
- Fix parse_url() return value not checked for false
- Fix decrypt() failures not handled (fallback to empty string)
- Sanitize log output (remove raw POST data from log messages)
- Replace weak == comparisons with strict === (PHP and JS)
SQL changes:
- Consolidate 4 migrations (2026021000-03) into single 2026021000
- Remove now unused notify_sound_url column
- Add smtp_username, smtp_password, sieve_username, sieve_password columns
- Increase password column from varchar(64) to varchar(255) to
prevent silent truncation of encrypted passwords
- Add missing UNIQUE constraint on iid in MySQL
- Add missing IX_ident_switch_iid index in PostgreSQL
- Remove deprecated int display width in MySQL (int(10) -> int)
- Fix trailing comma syntax error in SQLite 2018121800 migration
- Normalize indentation across all initial SQL files
- Add migration 2026021000 for all engines to fix existing installs
