fix(ical): only accept known columns as the calendar start date

The calendar_project_tasks and calendar_user_tasks settings were used as a
column name in the iCal query, and escapeIdentifier() leaves values with a
space or a dot untouched. A stored value like "1 OR 1=1 OR 1" made the public
project feed return tasks from every project.

Only date_creation and date_started are accepted now, anything else falls
back to date_started. The currency form also stops saving keys other than
application_currency, which is how the value could be written in the first
place.

Fixes #5904

tests/units/Controller/CurrencyControllerTest.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace KanboardTests\units\Controller;
+
+use Kanboard\Controller\CurrencyController;
+use Kanboard\Core\Http\Request;
+use Kanboard\Core\Http\Response;
+use KanboardTests\units\Base;
+
+class CurrencyControllerTest extends Base
+{
+    public function testChangingTheCurrencyDoesNotSaveOtherSettings()
+    {
+        $this->container['request'] = new Request(
+            $this->container,
+            array('REQUEST_METHOD' => 'POST'),
+            array(),
+            array(
+                'csrf_token' => $this->container['token']->getCSRFToken(),
+                'application_currency' => 'EUR',
+                'calendar_project_tasks' => '1 OR 1=1 OR 1',
+            ),
+            array(),
+            array()
+        );
+
+        $this->container['response'] = $this->getMockBuilder(Response::class)
+            ->setConstructorArgs(array($this->container))
+            ->onlyMethods(array('redirect'))
+            ->getMock();
+
+        $this->container['response']
+            ->expects($this->once())
+            ->method('redirect');
+
+        (new CurrencyController($this->container))->update();
+
+        $this->assertEquals('EUR', $this->container['configModel']->getOption('application_currency'));
+        $this->assertEquals('date_started', $this->container['configModel']->getOption('calendar_project_tasks'));
+    }
+}