From caa05e779a46d5086962bedadb07a2cd04be0971 Mon Sep 17 00:00:00 2001
From: Raul Ochoa <rochoaf@gmail.com>
Date: Wed, 14 Jan 2015 18:11:13 +0100
Subject: [PATCH] Add scale_factor param as valid one

---
 lib/cartodb/server_options.js | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/lib/cartodb/server_options.js b/lib/cartodb/server_options.js
index f86a9673..2ac87baa 100644
--- a/lib/cartodb/server_options.js
+++ b/lib/cartodb/server_options.js
@@ -15,6 +15,24 @@ if ( _.isUndefined(global.environment.sqlapi.domain) ) {
   }
 }
 
+// Whitelist query parameters and attach format
+var REQUEST_QUERY_PARAMS_WHITELIST = [
+    'sql',
+    'geom_type',
+    'cache_buster',
+    'cache_policy',
+    'callback',
+    'interactivity',
+    'map_key',
+    'api_key',
+    'auth_token',
+    'style',
+    'style_version',
+    'style_convert',
+    'config',
+    'scale_factor'
+];
+
 module.exports = function(redisPool) {
     var redisOpts = redisPool ? {pool: redisPool} : global.environment.redis;
     var cartoData = require('cartodb-redis')(redisOpts),
@@ -659,9 +677,7 @@ module.exports = function(redisPool) {
           return;
         }
 
-        // Whitelist query parameters and attach format
-        var good_query = ['sql', 'geom_type', 'cache_buster', 'cache_policy', 'callback', 'interactivity', 'map_key', 'api_key', 'auth_token', 'style', 'style_version', 'style_convert', 'config' ];
-        var bad_query  = _.difference(_.keys(req.query), good_query);
+        var bad_query  = _.difference(_.keys(req.query), REQUEST_QUERY_PARAMS_WHITELIST);
 
         _.each(bad_query, function(key){ delete req.query[key]; });
         req.params =  _.extend({}, req.params); // shuffle things as request is a strange array/object