[FIX] web_editor, *: review `public_render_template`

*: website, base

The normal flow to render a template is now to use `render_public_asset`
which bypasses the read access rights if the user matches the groups
the view declares.

For public users, we still cannot use that as they do not have access
to calling model methods at all. The route `public_render_template` is
thus still needed, but it should use the `render_public_asset` util. In
master, it will only rely on it but as a stable fix, we still need to
use the whitelist as we cannot change the related views' group.

This commit also adds deprecated comments to the read_template method
which has been removed in master.

Related to task-2412544

closes odoo/odoo#64137

Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>

4 files changed, 14 insertions, 5 deletions

diff --git a/addons/web_editor/controllers/main.py b/addons/web_editor/controllers/main.py
index e85a678f54e..b8f3b3eb36f 100644
--- a/addons/web_editor/controllers/main.py
+++ b/addons/web_editor/controllers/main.py
@@ -471,10 +471,14 @@ class Web_Editor(http.Controller):
         values = len_args > 1 and args[1] or {}
 
         View = request.env['ir.ui.view']
-        if request.env.user._is_public() \
-                and xmlid in request.env['web_editor.assets']._get_public_asset_xmlids():
-            View = View.sudo()
-        return View._render_template(xmlid, {k: values[k] for k in values if k in trusted_value_keys})
+        if xmlid in request.env['web_editor.assets']._get_public_asset_xmlids():
+            # For white listed assets, bypass access verification
+            # TODO in master this part should be removed and simply use the
+            # public group on the related views instead. And then let the normal
+            # flow handle the rendering.
+            return View.sudo()._render_template(xmlid, {k: values[k] for k in values if k in trusted_value_keys})
+        # Otherwise use normal flow
+        return View.render_public_asset(xmlid, {k: values[k] for k in values if k in trusted_value_keys})
 
     @http.route('/web_editor/modify_image/<model("ir.attachment"):attachment>', type="json", auth="user", website=True)
     def modify_image(self, attachment, res_model=None, res_id=None, name=None, data=None, original_id=None):
diff --git a/addons/web_editor/models/ir_ui_view.py b/addons/web_editor/models/ir_ui_view.py
index 4faa9ef0474..e7fe4b3617d 100644
--- a/addons/web_editor/models/ir_ui_view.py
+++ b/addons/web_editor/models/ir_ui_view.py
@@ -29,6 +29,8 @@ class IrUiView(models.Model):
 
     @api.model
     def read_template(self, xml_id):
+        """ This method is deprecated
+        """
         if xml_id == 'web_editor.colorpicker' and self.env.user.has_group('base.group_user'):
             # TODO this should be handled another way but was required as a
             # stable fix in 14.0. The views are now private by default: they
diff --git a/addons/website/models/ir_ui_view.py b/addons/website/models/ir_ui_view.py
index e51c6eff524..b4237c74715 100644
--- a/addons/website/models/ir_ui_view.py
+++ b/addons/website/models/ir_ui_view.py
@@ -326,6 +326,8 @@ class View(models.Model):
 
     @api.model
     def read_template(self, xml_id):
+        """ This method is deprecated
+        """
         view = self._view_obj(self.get_view_id(xml_id))
         if view.visibility and view._handle_visibility(do_raise=False):
             self = self.sudo()
diff --git a/odoo/addons/base/models/ir_ui_view.py b/odoo/addons/base/models/ir_ui_view.py
index 5d778d66f72..c77316d4557 100644
--- a/odoo/addons/base/models/ir_ui_view.py
+++ b/odoo/addons/base/models/ir_ui_view.py
@@ -1579,7 +1579,8 @@ actual arch.
 
     @api.model
     def read_template(self, xml_id):
-        """ Return a template content based on external id
+        """ This method is deprecated
+        Return a template content based on external id
         Read access on ir.ui.view required
         """
         template_id = self.get_view_id(xml_id)