fix-jsonp-serialization.diff

diff --git a/indico/web/http_api/handlers.py b/indico/web/http_api/handlers.py
index 712cbc8..2de3935 100644
--- a/indico/web/http_api/handlers.py
+++ b/indico/web/http_api/handlers.py
@@ -280,7 +280,7 @@ def handler(prefix, path):
         if error is None and request.method == 'POST':
             logger.info('API request: %s?%s' % (path, query))
 
-        serializer = Serializer.create(dformat, pretty=pretty, typeMap=typeMap,
+        serializer = Serializer.create(dformat, query_params=queryParams, pretty=pretty, typeMap=typeMap,
                                        **hook.serializer_args)
         if error:
             if not serializer.schemaless:
diff --git a/indico/web/http_api/metadata/jsonp.py b/indico/web/http_api/metadata/jsonp.py
index ad6a923..6c5dc0f 100644
--- a/indico/web/http_api/metadata/jsonp.py
+++ b/indico/web/http_api/metadata/jsonp.py
@@ -25,7 +25,9 @@ class JSONPSerializer(JSONSerializer):
     Just adds prefix
     """
 
+
     _mime = 'application/javascript'
+    _accept_args = ['jsonp']
 
     def __init__(self, jsonp='read', **kwargs):
         super(JSONPSerializer, self).__init__(**kwargs)
diff --git a/indico/web/http_api/metadata/serializer.py b/indico/web/http_api/metadata/serializer.py
index 67cdeb4..dd0fa13 100644
--- a/indico/web/http_api/metadata/serializer.py
+++ b/indico/web/http_api/metadata/serializer.py
@@ -21,6 +21,8 @@
 
 class Serializer(object):
 
+    _accept_args = []
+
     schemaless = True
     encapsulate = True
 
@@ -41,15 +43,20 @@ class Serializer(object):
         return list(cls.registry)
 
     @classmethod
-    def create(cls, dformat, **kwargs):
+    def create(cls, dformat, query_params=None, **kwargs):
         """
         A serializer factory
         """
 
+        query_params = query_params or {}
+
         serializer = cls.registry.get(dformat)
 
         if serializer:
-            return serializer(**kwargs)
+            # Collect whitelisted parameters from `query_params` which are specific to this serializer
+            params = {key: val for key, val in query_params.items() if key in serializer._accept_args}
+            params.update(kwargs)
+            return serializer(**params)
         else:
             raise Exception("Serializer for '%s' does not exist!" % dformat)