dovecot - Jul 2014 - After upgrade from 2.1 to 2.2.13 clients can create folders with names containing slash character on a Linux system

We have following issue: After upgrade from 2.1 to 2.2.13 clients can 
create folders with names containing slash character.
This was not possible with our previous version 2.1. Tested.

Our Dovecot runs on Debian Wheezy system. According 
http://wiki2.dovecot.org/Plugins/Listescape this should be disabled on  
a Posix system.

We use the usual separator '.' as you can see in the config file later.

Issue can be reproduced using outlook 2013.

On the file system this is the representation of the "Family/Friends" 
folder

/home/vpopmail/domains/0/example.org/steve/Maildir/.Family/Friends
/home/vpopmail/domains/0/example.org/steve/Maildir/.Family/Friends/new
/home/vpopmail/domains/0/example.org/steve/Maildir/.Family/Friends/tmp
/home/vpopmail/domains/0/example.org/steve/Maildir/.Family/Friends/cur

Doveadm does not lists properly the folder

doveadm mailbox list -usteve at alltimes.com  |grep -i Family
INBOX.Family

This is the server configuration:

-----------------------
dovecot -n
# 2.2.13: /dovecot/etc/dovecot/dovecot.conf
# OS: Linux 3.2.59-grsec x86_64 Debian 7.6
auth_username_chars = 
"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890@!#$&\'*+=?^_`{|}~.-"
base_dir = /var/run/dovecot/
disable_plaintext_auth = no
listen = *
login_log_format_elements = user=<%u> method=%m rip=%r lip=%l pid=%p %c
mail_access_groups = vchkpw
mail_fsync = never
mail_plugins = quota stats
namespace {
   inbox = yes
   location = maildir:~/Maildir:INDEX=/home/vpopmail/dovecot-indexes/%d/%n
   prefix = INBOX.
   separator = .
   type = private
}
passdb {
   args = /home/vpopmail/bin/chkpw
   driver = checkpassword
}
plugin {
   acl = vfile:/dovecot/acls
   quota = maildir
   quota_rule = INBOX.Trash:ignore
   stats_command_min_time = 1 mins
   stats_domain_min_time = 12 hours
   stats_ip_min_time = 12 hours
   stats_memory_limit = 64 M
   stats_refresh = 30 secs
   stats_session_min_time = 15 mins
   stats_track_cmds = yes
   stats_user_min_time = 1 hours
}
protocols = imap pop3
service imap-login {
   executable = /dovecot/libexec/dovecot/imap-login
   inet_listener imap {
     address = *
     port = 143
   }
   inet_listener imaps {
     address = *
     port = 993
   }
   process_min_avail = 16
   service_count = 0
}
service imap {
   executable = /dovecot/libexec/dovecot/imap-ld-hack
   process_limit = 1500
   vsz_limit = 256 M
}
service pop3-login {
   process_min_avail = 16
   service_count = 0
}
service pop3 {
   executable = /dovecot/libexec/dovecot/pop3-ld-hack
   process_limit = 1500
   vsz_limit = 256 M
}
service stats {
   fifo_listener stats-mail {
     mode = 0600
     user = vpopmail
   }
}
ssl_ca = </apache/conf/ssl.crt/server-ca.crt
ssl_cert = </apache/conf/ssl.crt/server.crt
ssl_cipher_list = ALL:-ADH:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP
ssl_key = </apache/conf/ssl.key/server.key
userdb {
   driver = vpopmail
}
userdb {
   driver = prefetch
}
protocol imap {
   imap_client_workarounds    mail_max_userip_connections = 100
   mail_plugins = quota stats acl imap_quota imap_stats
}
protocol pop3 {
   mail_max_userip_connections = 100
   mail_plugins = quota stats acl
   pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
   pop3_enable_last = yes
   pop3_no_flag_updates = yes
   pop3_uidl_format = %f
}
-----------------------

We need a way to prevent creation of those folders, because our users 
create several of them a day. Any suggestions?

regards,
David Davidov

On 24 Jul 2014, at 17:30, David Davidov <dave at icdsoft.com> wrote:
> We have following issue: After upgrade from 2.1 to 2.2.13 clients can
create folders with names containing slash character.
> This was not possible with our previous version 2.1. Tested.
Oops, fixed: http://hg.dovecot.org/dovecot-2.2/rev/4b8a098a70b7