From d210643d63cc47fb67c76a970b14b637417ec180 Mon Sep 17 00:00:00 2001
From: Raul Ochoa <rochoaf@gmail.com>
Date: Thu, 26 Mar 2015 17:19:16 +0100
Subject: [PATCH] Only required query params

---
 lib/cartodb/server_options.js | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/lib/cartodb/server_options.js b/lib/cartodb/server_options.js
index d1dbb11c..e595d26b 100644
--- a/lib/cartodb/server_options.js
+++ b/lib/cartodb/server_options.js
@@ -10,13 +10,11 @@ var assert = require('assert');
 
 // Whitelist query parameters and attach format
 var REQUEST_QUERY_PARAMS_WHITELIST = [
-    'user',
-    'callback',
+    'config',
     'map_key',
     'api_key',
     'auth_token',
-    'config',
-    'scale_factor'
+    'callback'
 ];
 
 module.exports = function(redisPool) {
@@ -495,7 +493,7 @@ module.exports = function(redisPool) {
             lzma,
             function(result) {
               if (req.profiler) {
-                  req.profiler.done('LZMA decompress');
+                  req.profiler.done('lzma');
               }
               try {
                 delete req.query.lzma;
@@ -504,18 +502,13 @@ module.exports = function(redisPool) {
               } catch (err) {
                 callback(new Error('Error parsing lzma as JSON: ' + err));
               }
-            },
-            function(/*percent*/) { // progress
-              //console.log("LZMA decompression " + percent + "%");
             }
           );
           return;
         }
 
-        var bad_query  = _.difference(_.keys(req.query), REQUEST_QUERY_PARAMS_WHITELIST);
-
-        _.each(bad_query, function(key){ delete req.query[key]; });
-        req.params =  _.extend({}, req.params); // shuffle things as request is a strange array/object
+        req.query = _.pick(req.query, REQUEST_QUERY_PARAMS_WHITELIST);
+        req.params = _.extend({}, req.params); // shuffle things as request is a strange array/object
 
         var user = cdbRequest.userByReq(req);