Do not pass res.locals to collaborators

lib/cartodb/backends/analysis-status.js

@@ -5,16 +5,14 @@ function AnalysisStatusBackend() {
 
 module.exports = AnalysisStatusBackend;
 
-
-AnalysisStatusBackend.prototype.getNodeStatus = function (params, callback) {
-    var nodeId = params.nodeId;
-
+AnalysisStatusBackend.prototype.getNodeStatus = function (nodeId, dbParams, callback) {
     var statusQuery = [
         'SELECT node_id, status, updated_at, last_error_message as error_message',
         'FROM cdb_analysis_catalog where node_id = \'' + nodeId + '\''
     ].join(' ');
 
-    var pg = new PSQL(dbParamsFromReqParams(params));
+    var pg = new PSQL(dbParams);
+
     pg.query(statusQuery, function(err, result) {
         if (err) {
             return callback(err, result);
@@ -36,23 +34,3 @@ AnalysisStatusBackend.prototype.getNodeStatus = function (params, callback) {
         return callback(null, statusResponse);
     }, true); // use read-only transaction
 };
-
-function dbParamsFromReqParams(params) {
-    var dbParams = {};
-    if ( params.dbuser ) {
-        dbParams.user = params.dbuser;
-    }
-    if ( params.dbpassword ) {
-        dbParams.pass = params.dbpassword;
-    }
-    if ( params.dbhost ) {
-        dbParams.host = params.dbhost;
-    }
-    if ( params.dbport ) {
-        dbParams.port = params.dbport;
-    }
-    if ( params.dbname ) {
-        dbParams.dbname = params.dbname;
-    }
-    return dbParams;
-}

lib/cartodb/controllers/analyses.js

@@ -11,6 +11,7 @@ const rateLimit = require('../middleware/rate-limit');
 const { RATE_LIMIT_ENDPOINTS_GROUPS } = rateLimit;
 const cacheControlHeader = require('../middleware/cache-control-header');
 const sendResponse = require('../middleware/send-response');
+const dbParamsFromResLocals = require('../utils/database-params');
 
 function AnalysesController(pgConnection, authApi, userLimitsApi) {
     this.pgConnection = pgConnection;
@@ -46,7 +47,10 @@ AnalysesController.prototype.register = function (app) {
 
 function createPGClient () {
     return function createPGClientMiddleware (req, res, next) {
-        res.locals.pg = new PSQL(dbParamsFromReqParams(res.locals));
+        const dbParams = dbParamsFromResLocals(res.locals);
+
+        res.locals.pg = new PSQL(dbParams);
+
         next();
     };
 }
@@ -146,23 +150,3 @@ var tablesQueryTpl = ctx => `
     FROM analysis_tables
     ORDER BY size DESC
 `;
-
-function dbParamsFromReqParams(params) {
-    var dbParams = {};
-    if ( params.dbuser ) {
-        dbParams.user = params.dbuser;
-    }
-    if ( params.dbpassword ) {
-        dbParams.pass = params.dbpassword;
-    }
-    if ( params.dbhost ) {
-        dbParams.host = params.dbhost;
-    }
-    if ( params.dbport ) {
-        dbParams.port = params.dbport;
-    }
-    if ( params.dbname ) {
-        dbParams.dbname = params.dbname;
-    }
-    return dbParams;
-}

lib/cartodb/controllers/layergroup.js

@@ -17,6 +17,8 @@ const sendResponse = require('../middleware/send-response');
 const DataviewBackend = require('../backends/dataview');
 const AnalysisStatusBackend = require('../backends/analysis-status');
 const MapStoreMapConfigProvider = require('../models/mapconfig/provider/map-store-provider');
+const dbParamsFromResLocals = require('../utils/database-params');
+
 const SUPPORTED_FORMATS = {
     grid_json: true,
     json_torque: true,
@@ -383,7 +385,10 @@ function distinguishLayergroupFromStaticRoute () {
 
 function analysisNodeStatus (analysisStatusBackend) {
     return function analysisNodeStatusMiddleware(req, res, next) {
-        analysisStatusBackend.getNodeStatus(res.locals, (err, nodeStatus, stats = {}) => {
+        const { nodeId } = req.params;
+        const dbParams = dbParamsFromResLocals(res.locals);
+
+        analysisStatusBackend.getNodeStatus(nodeId, dbParams, (err, nodeStatus, stats = {}) => {
             req.profiler.add(stats);
 
             if (err) {

lib/cartodb/utils/database-params.js

@@ -0,0 +1,25 @@
+module.exports = function getDatabaseConnectionParams (params) {
+    const dbParams = {};
+
+    if (params.dbuser) {
+        dbParams.user = params.dbuser;
+    }
+
+    if (params.dbpassword) {
+        dbParams.pass = params.dbpassword;
+    }
+
+    if (params.dbhost) {
+        dbParams.host = params.dbhost;
+    }
+
+    if (params.dbport) {
+        dbParams.port = params.dbport;
+    }
+
+    if (params.dbname) {
+        dbParams.dbname = params.dbname;
+    }
+
+    return dbParams;
+};