I agree that there should be a $CONFIG variable to disable it entirely, thereby giving the admin and the users a choice.
If there isn't much interest in a config file override, that's OK, I can patch RoundCube locally so that option isn't available to users. I already apply a patch that allows me to white list users. I simply thought I'd point out that HTML isn't always viewed as desirable, although it seems to be an opinion fewer people have.
However I do think the option for HTML messages should be off by default.
Charles Dostale System Admin - Silver Oaks Communications http://www.silveroaks.com/ 824 17th Street, Moline IL 61265