From 12279d5c00b77f42782f3375689a1b2c4a90880f Mon Sep 17 00:00:00 2001
From: Raul Ochoa <rochoaf@gmail.com>
Date: Thu, 2 Feb 2017 16:20:16 +0100
Subject: [PATCH] Cast dataview override values to Number or throw error

We were letting params expected as Numbers to be passed as any type
when they were not Numbers.
---
 lib/cartodb/backends/dataview.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/cartodb/backends/dataview.js b/lib/cartodb/backends/dataview.js
index 0be51713..e0515efe 100644
--- a/lib/cartodb/backends/dataview.js
+++ b/lib/cartodb/backends/dataview.js
@@ -79,7 +79,10 @@ DataviewBackend.prototype.getDataview = function (mapConfigProvider, user, param
 
             var overrideParams = _.reduce(_.pick(params, 'start', 'end', 'bins'),
                 function castNumbers(overrides, val, k) {
-                    overrides[k] = Number.isFinite(+val) ? +val : val;
+                    if (!Number.isFinite(+val)) {
+                        throw new Error('Invalid number format for parameter \'' + k + '\'');
+                    }
+                    overrides[k] = +val;
                     return overrides;
                 },
                 {ownFilter: ownFilter}