xwiki/xwiki-platform — pull request #124 by tdelafosse (2013-07-01 13:17:09+00:00)
Title: XWiki-5513 : Unprivileged users can make arbitrary select queries with DatabaseListProperty.

I propose to use the query manager instead of the old insecure xwiki.search(). Unprivileged users won't be able to make full form statement queries anymore.