The security bug is confirmed. Apparently, no one has used this ini setting so far. As to the EndDate, remember that it's called EndDate, not EndYear.