settings section just hidden, but can still be set

[YveIce]

This is not a safe way to prevent user-changes in sections, we do not want the user to do.
For example you can config to hide section 'compose'. This section will no longer be shown on the preference-page. BUT! You can still call the page directly:
http://your.roundcube.server/?_task=settings&_action=edit-prefs&_section=compose
were you get the token to submit new values via POST.
So we just need to know the name of the fields, and we can still change everything we want to, as long as it is in the whitelist (see: program/steps/utils/save_pref.inc).