Configure extra allowed params per endpoint via middleware

Instead of making all params available in all endpoints, we control
what endpoints allow what extra params.

Dataviews endpoints should be migrated to this.

lib/cartodb/controllers/base.js

@@ -36,7 +36,7 @@ function BaseController(authApi, pgConnection) {
 
 module.exports = BaseController;
 
-// jshint maxcomplexity:9
+// jshint maxcomplexity:10
 /**
  * Whitelist input and get database name & default geometry type from
  * subdomain/user metadata held in CartoDB Redis
@@ -77,7 +77,11 @@ BaseController.prototype.req2params = function(req, callback){
         return;
     }
 
-    req.query = _.pick(req.query, REQUEST_QUERY_PARAMS_WHITELIST);
+    var allowedQueryParams = REQUEST_QUERY_PARAMS_WHITELIST;
+    if (Array.isArray(req.context.allowedQueryParams)) {
+        allowedQueryParams = allowedQueryParams.concat(req.context.allowedQueryParams);
+    }
+    req.query = _.pick(req.query, allowedQueryParams);
     req.params = _.extend({}, req.params); // shuffle things as request is a strange array/object
 
     var user = req.context.user;

lib/cartodb/controllers/layergroup.js

@@ -6,6 +6,7 @@ var BaseController = require('./base');
 
 var cors = require('../middleware/cors');
 var userMiddleware = require('../middleware/user');
+var allowQueryParams = require('../middleware/allow-query-params');
 
 var DataviewBackend = require('../backends/dataview');
 var AnalysisStatusBackend = require('../backends/analysis-status');
@@ -67,11 +68,13 @@ LayergroupController.prototype.register = function(app) {
         this.attributes.bind(this));
 
     app.get(app.base_url_mapconfig +
-        '/static/center/:token/:z/:lat/:lng/:width/:height.:format', cors(), userMiddleware,
+        '/static/center/:token/:z/:lat/:lng/:width/:height.:format',
+        cors(), userMiddleware, allowQueryParams(['layer']),
         this.center.bind(this));
 
     app.get(app.base_url_mapconfig +
-        '/static/bbox/:token/:west,:south,:east,:north/:width/:height.:format', cors(), userMiddleware,
+        '/static/bbox/:token/:west,:south,:east,:north/:width/:height.:format',
+        cors(), userMiddleware, allowQueryParams(['layer']),
         this.bbox.bind(this));
 
     // Undocumented/non-supported API endpoint methods.

lib/cartodb/controllers/named_maps.js

@@ -8,6 +8,7 @@ var BaseController = require('./base');
 
 var cors = require('../middleware/cors');
 var userMiddleware = require('../middleware/user');
+var allowQueryParams = require('../middleware/allow-query-params');
 
 function NamedMapsController(authApi, pgConnection, namedMapProviderCache, tileBackend, previewBackend,
                              surrogateKeysCache, tablesExtentApi, metadataBackend) {
@@ -31,7 +32,7 @@ NamedMapsController.prototype.register = function(app) {
         this.tile.bind(this));
 
     app.get(app.base_url_mapconfig +
-        '/static/named/:template_id/:width/:height.:format', cors(), userMiddleware,
+        '/static/named/:template_id/:width/:height.:format', cors(), userMiddleware, allowQueryParams(['layer']),
         this.staticMap.bind(this));
 };
 

lib/cartodb/middleware/allow-query-params.js

@@ -0,0 +1,6 @@
+module.exports = function allowQueryParams(params) {
+    return function allowQueryParamsMiddleware(req, res, next) {
+        req.context.allowedQueryParams = params;
+        next();
+    };
+};