Store allowlist for exposed directory server

src/routes/settings.js

@@ -148,6 +148,7 @@ async function setExposedLdapConfig(req, res, next) {
     assert.strictEqual(typeof req.body, 'object');
 
     if (typeof req.body.enabled !== 'boolean') return next(new HttpError(400, 'enabled must be a boolean'));
+    if ('allowlist' in req.body && typeof req.body.allowlist !== 'string') return next(new HttpError(400, 'allowlist must be a string'));
 
     const [error] = await safe(settings.setExposedLdapConfig(req.body));
     if (error) return next(BoxError.toHttpError(error));