dualfroz
23bbaa8c60
The calendar_project_tasks and calendar_user_tasks settings were used as a column name in the iCal query, and escapeIdentifier() leaves values with a space or a dot untouched. A stored value like "1 OR 1=1 OR 1" made the public project feed return tasks from every project. Only date_creation and date_started are accepted now, anything else falls back to date_started. The currency form also stops saving keys other than application_currency, which is how the value could be written in the first place. Fixes #5904