im scared about that fact, but then, I am always paranoid

It seems safe enough. You have to remember PHP is processed SERVER side, so only the server will read the cPanel password, and nothing else. Seems ok to me.

true enough as I suppose we leave our database passwords on the server

In a protected admin directory ;)

Installed and works well ... great addition.

Thanks lebanon .. clicked install.

what happens with users who have other special characters in their name ... such as @ ~ # * etc?

good question...

This is an absolute security risk, if the webserver should load without php for some reason then yes php files will be readable like any other text file, or downloadable, as the server side will not process it.

I suggest you use a require or include to a file outside of webroot where it would be much safer which contains the cpanel info. Otherwise with the right domains in your pocket this hack is per chance very interesting. ;)

so how do i configure the source code to add in groups that i'd want to access the email?

I havent really considered all cases but since you mentioned it , its doable.
I already took care of users wit Blank spaces where you could find at
Line containing ( in email.php )
$cpun1 = str_replace( " ", ".", $cpun );
Now you could rerun this same line for as much characters u suppose ur members or vbulletin allows and the second value is what it will be
so you could do
$cpun1 = str_replace( " ", ".", $cpun );
$cpun1 = str_replace( "#", ".", $cpun );
$cpun1 = str_replace( "~", ".", $cpun );
( i didnt even notice any forum member containing such characters so i havent really even thought of it except for spaces )

For other questions asked :
A live demo , that can be viewed on http://www.tchatting.com/forum/email.php but u will need to register thats why i added screenies instead .

//nitro and PtP : As for the PHP security guys are bothered about , just remember ALL scripts, forums, cms shopping carts and every known portal has its KNOWN location of its config files , how come this question was raisen here and u have never worried about everything else you add ur info to ?
PHP is processed before it outputs data to client side. (thus its safe )
Last comment i also read, someone suggested if php didnt run it will expose it , true , but trust me , if your server php stopped being processed for some reason your last worries would be my files !//

freako9699 : u dont need to create emails for ur users, THEY will activate their own emails , thats what this extension is for !
You add your cpanel details into the config, then you announce to ur users that they can have their free email at /email.php and thats it.

Snoop-It : to have a vb interface that will require a full email addon as well. I am projecting on doing such thing but that but still looking for Lots of free time.

moonclamp : file to upload are on ur forum root not domain root.
No strains on server no , and as for users deleted , they will keep their emails u should do it manually then , though we can add functions to this one.