<ul><li>Fixed SQL injection in EmailSettingsController.php: date_from and date_to POST inputs in getLog and getUsage actions now validated against Y-m-d regex before interpolation into SQL WHERE clause</li><li>Fixed CSRF token mismatch in emails.php legacy template: replaced __TOKEN constant (undefined in some session states) with $globalclass->csrf_token() which generates the token if missing</li><li>Backed up both files before modification</li></ul>