fix all vulnerabilities in the production code (#817)

Signed-off-by: Denis barbaron <denis.barbaron@orange.com>

lib/units/auth/ldap.js

@@ -5,11 +5,10 @@
 var http = require('http')
 
 var express = require('express')
-var validator = require('express-validator')
 var cookieSession = require('cookie-session')
 var bodyParser = require('body-parser')
 var serveStatic = require('serve-static')
-var csrf = require('csurf')
+var csrf = require('@dr.pogodin/csurf')
 var Promise = require('bluebird')
 
 var logger = require('../../util/logger')
@@ -46,7 +45,6 @@ module.exports = function(options) {
   }))
   app.use(bodyParser.json())
   app.use(csrf())
-  app.use(validator())
   app.use('/static/bower_components',
     serveStatic(pathutil.resource('bower_components')))
   app.use('/static/auth/ldap', serveStatic(pathutil.resource('auth/ldap')))
@@ -84,15 +82,12 @@ module.exports = function(options) {
     res.render('index')
   })
 
-  app.post('/auth/api/v1/ldap', function(req, res) {
+  app.post('/auth/api/v1/ldap', requtil.validators.ldapLoginValidator, function(req, res) {
     var log = logger.createLogger('auth-ldap')
     log.setLocalIdentifier(req.ip)
     switch (req.accepts(['json'])) {
       case 'json':
-        requtil.validate(req, function() {
-            req.checkBody('username').notEmpty()
-            req.checkBody('password').notEmpty()
-          })
+        requtil.validate(req)
           .then(function() {
             return ldaputil.login(
               options.ldap