В cli добавлен параметр 'unsafe-filter'

server/core/DbCreator.js

@@ -76,8 +76,12 @@ class DbCreator {
         if (inpxFilter) {
 
             let recFilter = () => true;
-            if (inpxFilter.filter)
-                recFilter = new Function(`'use strict'; return ${inpxFilter.filter}`)();
+            if (inpxFilter.filter) {
+                if (config.allowUnsafeFilter)
+                    recFilter = new Function(`'use strict'; return ${inpxFilter.filter}`)();
+                else
+                    throw new Error(`Unsafe property 'filter' detected in ${this.config.inpxFilterFile}. Please specify '--unsafe-filter' param if you know what you're doing.`);
+            }
 
             filter = (rec) => {
                 let author = rec.author;

server/index.js

@@ -104,6 +104,7 @@ async function init() {
 
     config.recreateDb = argv.recreate || false;
     config.inpxFilterFile = `${config.execDir}/inpx-web-filter.json`;
+    config.allowUnsafeFilter = argv['unsafe-filter'] || false;
 
     //app
     const appDir = `${config.publicDir}/app`;