From 8c27d483642e85e2da721795c367466c8b40e6fa Mon Sep 17 00:00:00 2001
From: juhanikat <juhani.kataja@gmail.com>
Date: Mon, 26 Oct 2026 12:48:56 +0200
Subject: [PATCH] Add "crosssearch/all, /localities, /export" to allowed post
 routes in production

---
 backend/src/app.ts                | 2 --
 backend/src/middlewares/misc.ts   | 3 +++
 backend/src/routes/crossSearch.ts | 2 +-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/backend/src/app.ts b/backend/src/app.ts
index 20c105a32..138ad7813 100644
--- a/backend/src/app.ts
+++ b/backend/src/app.ts
@@ -40,9 +40,7 @@ const app = express()
 app.use(express.json({ limit: '50mb' }))
 app.use(cors())
 app.use(compression())
-
 app.use(responseLogger)
-
 if (!ENABLE_WRITE && RUNNING_ENV !== 'dev') {
   app.use(blockWriteRequests)
 }
diff --git a/backend/src/middlewares/misc.ts b/backend/src/middlewares/misc.ts
index d3f825e50..5ec4d17cd 100644
--- a/backend/src/middlewares/misc.ts
+++ b/backend/src/middlewares/misc.ts
@@ -3,6 +3,9 @@ import { Middleware } from '../types'
 /* Disables all write routes except the ones excluded by "allowedRoutes" */
 export const blockWriteRequests: Middleware = (req, res, next) => {
   const allowedRoutes = [
+    '/crosssearch/all',
+    '/crosssearch/localities',
+    '/crosssearch/export',
     '/user/login',
     '/locality-species',
     '/refreshToken',
diff --git a/backend/src/routes/crossSearch.ts b/backend/src/routes/crossSearch.ts
index dcfba9e54..ae1b0966c 100644
--- a/backend/src/routes/crossSearch.ts
+++ b/backend/src/routes/crossSearch.ts
@@ -175,7 +175,7 @@ const streamCrossSearchExport = async (req: Request, res: Response, parameters:
   let dataArray: Partial<CrossSearch[][]>
   try {
     dataArray = (await getCrossSearchRawSql(
-      req.user,
+      req.user, // req.user comes from the userExtractor middleware, so should be secure
       undefined,
       undefined,
       parsedValues.validatedValues.validatedColumnFilters,