33 lines
816 B
JavaScript
33 lines
816 B
JavaScript
const _ = require('underscore');
|
|
|
|
// Whitelist query parameters and attach format
|
|
const REQUEST_QUERY_PARAMS_WHITELIST = [
|
|
'config',
|
|
'map_key',
|
|
'api_key',
|
|
'auth_token',
|
|
'callback',
|
|
'zoom',
|
|
'lon',
|
|
'lat',
|
|
// analysis
|
|
'filters' // json
|
|
];
|
|
|
|
module.exports = function cleanUpQueryParamsMiddleware () {
|
|
return function cleanUpQueryParams (req, res, next) {
|
|
var allowedQueryParams = REQUEST_QUERY_PARAMS_WHITELIST;
|
|
|
|
if (Array.isArray(res.locals.allowedQueryParams)) {
|
|
allowedQueryParams = allowedQueryParams.concat(res.locals.allowedQueryParams);
|
|
}
|
|
|
|
req.query = _.pick(req.query, allowedQueryParams);
|
|
|
|
// bring all query values onto res.locals object
|
|
_.extend(res.locals, req.query);
|
|
|
|
next();
|
|
};
|
|
};
|