fix(ical): only accept known columns as the calendar start date

The calendar_project_tasks and calendar_user_tasks settings were used as a
column name in the iCal query, and escapeIdentifier() leaves values with a
space or a dot untouched. A stored value like "1 OR 1=1 OR 1" made the public
project feed return tasks from every project.

Only date_creation and date_started are accepted now, anything else falls
back to date_started. The currency form also stops saving keys other than
application_currency, which is how the value could be written in the first
place.

Fixes #5904

app/Controller/ICalendarController.php

@@ -31,7 +31,7 @@ class ICalendarController extends BaseController
         $startRange = strtotime('-2 months');
         $endRange = strtotime('+6 months');
 
-        $startColumn = $this->configModel->get('calendar_user_tasks', 'date_started');
+        $startColumn = $this->getStartColumn('calendar_user_tasks');
 
         $calendar = new iCalendar('Kanboard');
         $calendar->setName($user['name'] ?: $user['username']);
@@ -71,7 +71,7 @@ class ICalendarController extends BaseController
         $startRange = strtotime('-2 months');
         $endRange = strtotime('+6 months');
 
-        $startColumn = $this->configModel->get('calendar_project_tasks', 'date_started');
+        $startColumn = $this->getStartColumn('calendar_project_tasks');
 
         $calendar = new iCalendar('Kanboard');
         $calendar->setName($project['name']);
@@ -99,6 +99,12 @@ class ICalendarController extends BaseController
             ->format());
     }
 
+    protected function getStartColumn($option)
+    {
+        $column = $this->configModel->get($option, 'date_started');
+        return in_array($column, array('date_creation', 'date_started'), true) ? $column : 'date_started';
+    }
+
     protected function getConditionForTasksWithStartAndDueDate($start_time, $end_time, $start_column, $end_column)
     {
         $start_time = (int) $start_time;