Fix reflected XSS in /metrics/find via from/until parameters
#2907
+13
−4
from/until parameters
#2907