last_totp_step tracking to iredadmin_2fa; a TOTP code accepted for a given 30-second window cannot be reused, preventing replay attacks within that window.timezone_identifiers_list() before being stored; invalid values fall back to the server default.sogo_cache_folder.sogo_admin table with direct grant/revoke controls for SOGo super-admin status.layout_top.php to prevent Cross-Site Scripting. Intentional markup in system messages has been converted to plain text for safe rendering.srcdoc iframe by removing the allow-same-origin attribute, further isolating embedded content from the parent window.BEHIND_PROXY to false by default. This ensures new direct installations are protected against IP spoofing unless the administrator explicitly enables proxy support.actions.php to execute postqueue -f.LOGIN_BLOCK_ATTEMPTS setting in config.php (default 5), creating a single threshold for password, 2FA, and username-based failures.seen column to the iredadmin_blocked_ips table, allowing the "unseen" status of blocks to persist in the database rather than volatile sessions.BEHIND_PROXY toggle in config.php (defaulting to false) to allow reading client IPs from the X-Real-IP header.behind_proxy setting in config.php to properly handle header processing when the application is placed behind a load balancer or reverse proxy./mxa/ subdirectory.iredadmin_blocked_ips database table, ensuring protection persists across server restarts.SYSTEM → Blocked IPs to monitor all active blocks, including attempt counts and block types (auto vs. manual).vmail.forwardings.is_mailist was being targeted incorrectly.vmail.forwardings.is_list.vmail.forwardings.is_forwarding flag to ensure proper mail routing for group members.secure, httponly, and Samesite => 'Lax' cookie settings to prevent XSS-based hijacking and CSRF attacks.chillerlan/php-qrcode. Secrets are now processed entirely on-site./app/ and /vendor/ directories and return 404s for unauthorized file targets.position: fixed for constant menu availability.groupModal for a focused administrative experience.config.php to define the specific number of recent admin logins and failed logins displayed.app/cron/parse_dovecot_log.php) and database table to track and display user "Last Login" details and source IPs.config.php file to the main repository; it is now included as a standard part of the packaged version.session_timeout in config.php to allow modification of the 1-hour default./etc/iredadmin/config.php./etc/nginx/templates/iredadmin-custom.tmpl to protect the app/ directory.NULL values instead of empty strings for strict database compatibility.