Add "crosssearch/all, /localities, /export" to allowed post routes in…

backend/src/app.ts

@@ -40,9 +40,7 @@ const app = express()
 app.use(express.json({ limit: '50mb' }))
 app.use(cors())
 app.use(compression())
-
 app.use(responseLogger)
-
 if (!ENABLE_WRITE && RUNNING_ENV !== 'dev') {
   app.use(blockWriteRequests)
 }

backend/src/middlewares/misc.ts

@@ -3,6 +3,9 @@ import { Middleware } from '../types'
 /* Disables all write routes except the ones excluded by "allowedRoutes" */
 export const blockWriteRequests: Middleware = (req, res, next) => {
   const allowedRoutes = [
+    '/crosssearch/all',
+    '/crosssearch/localities',
+    '/crosssearch/export',
     '/user/login',
     '/locality-species',
     '/refreshToken',

backend/src/routes/crossSearch.ts

@@ -175,7 +175,7 @@ const streamCrossSearchExport = async (req: Request, res: Response, parameters:
   let dataArray: Partial<CrossSearch[][]>
   try {
     dataArray = (await getCrossSearchRawSql(
-      req.user,
+      req.user, // req.user comes from the userExtractor middleware, so should be secure
       undefined,
       undefined,
       parsedValues.validatedValues.validatedColumnFilters,