Pull Request for Issue #31719

Summary of Changes

When you change your configuration for example

1. When you turn off SMTP with Authentication
2. When you change from SMTP with Authentication to another mail provider
3. When you turn off your outbound proxy

Joomla RETAINS your credentials in HIDDEN fields in Joomla global configuration and stores them in PLAIN TEXT in /configuration.php - but you don't know this because Joomla hides that fact from you.

A super admin, who has done one of the above actions is rightly assuming Joomla will discard the credentials as the credential input boxes are no longer shown to them.

Plus, why should Joomla retain - in plain text - credentials that it no longer needs to operate. This is an additional security issue should the site be compromised.

Testing Instructions

1. Enable SMTP with Authentication (you can fake the SMTP server, user and pass that's ok as Joomla doesnt validate them - doh!) and save Joomla Config. Inspect your configuration.php - see the credentials are there - now go back and switch to sendmail and save - Inspect your configuration.php - see the credentials are still there - now apply the PR and then go and repeat the test - you will see when you inspect configuration.php your secret credentials for SMTP server are no longer stored.

Same with outbound proxy.

Actual result BEFORE applying this Pull Request

Joomla stores forever the credentials of services no longer used, in plain text, in configuration.php

Expected result AFTER applying this Pull Request

Joomla deletes the credentials of services no longer used

Documentation Changes Required

None. Fully backward compatible.