diff --git a/lib/cartodb/controllers/layergroup.js b/lib/cartodb/controllers/layergroup.js index 614480a6..6ae62433 100644 --- a/lib/cartodb/controllers/layergroup.js +++ b/lib/cartodb/controllers/layergroup.js @@ -28,6 +28,21 @@ const SUPPORTED_FORMATS = { mvt: true }; +const ALLOWED_DATAVIEW_QUERY_PARAMS = [ + 'filters', // json + 'own_filter', // 0, 1 + 'no_filters', // 0, 1 + 'bbox', // w,s,e,n + 'start', // number + 'end', // number + 'column_type', // string + 'bins', // number + 'aggregation', //string + 'offset', // number + 'q', // widgets search + 'categories', // number +]; + /** * @param {prepareContext} prepareContext * @param {PgConnection} pgConnection @@ -242,25 +257,10 @@ LayergroupController.prototype.register = function(app) { // Undocumented/non-supported API endpoint methods. // Use at your own peril. - const allowedDataviewQueryParams = [ - 'filters', // json - 'own_filter', // 0, 1 - 'no_filters', // 0, 1 - 'bbox', // w,s,e,n - 'start', // number - 'end', // number - 'column_type', // string - 'bins', // number - 'aggregation', //string - 'offset', // number - 'q', // widgets search - 'categories', // number - ]; - app.get( `${mapConfigBasePath}/:token/dataview/:dataviewName`, cors(), - cleanUpQueryParams(allowedDataviewQueryParams), + cleanUpQueryParams(ALLOWED_DATAVIEW_QUERY_PARAMS), locals(), user(), rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW), @@ -285,7 +285,7 @@ LayergroupController.prototype.register = function(app) { app.get( `${mapConfigBasePath}/:token/:layer/widget/:dataviewName`, cors(), - cleanUpQueryParams(allowedDataviewQueryParams), + cleanUpQueryParams(ALLOWED_DATAVIEW_QUERY_PARAMS), locals(), user(), rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW), @@ -310,7 +310,7 @@ LayergroupController.prototype.register = function(app) { app.get( `${mapConfigBasePath}/:token/dataview/:dataviewName/search`, cors(), - cleanUpQueryParams(allowedDataviewQueryParams), + cleanUpQueryParams(ALLOWED_DATAVIEW_QUERY_PARAMS), locals(), user(), rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW_SEARCH), @@ -335,7 +335,7 @@ LayergroupController.prototype.register = function(app) { app.get( `${mapConfigBasePath}/:token/:layer/widget/:dataviewName/search`, cors(), - cleanUpQueryParams(allowedDataviewQueryParams), + cleanUpQueryParams(ALLOWED_DATAVIEW_QUERY_PARAMS), locals(), user(), rateLimit(this.userLimitsApi, RATE_LIMIT_ENDPOINTS_GROUPS.DATAVIEW_SEARCH),