[IMP] *: convert to private methods

render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id

Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.

1 files changed, 3 insertions, 3 deletions

diff --git a/addons/mail/models/mail_template.py b/addons/mail/models/mail_template.py
index c4d590e2729..f8f90aea5fd 100644
--- a/addons/mail/models/mail_template.py
+++ b/addons/mail/models/mail_template.py
@@ -196,9 +196,9 @@ class MailTemplate(models.Model):
                     report_service = report.report_name
 
                     if report.report_type in ['qweb-html', 'qweb-pdf']:
-                        result, format = report.render_qweb_pdf([res_id])
+                        result, format = report._render_qweb_pdf([res_id])
                     else:
-                        res = report.render([res_id])
+                        res = report._render([res_id])
                         if not res:
                             raise UserError(_('Unsupported report type %s found.') % report.report_type)
                         result, format = res
@@ -267,7 +267,7 @@ class MailTemplate(models.Model):
                     'company': 'company_id' in record and record['company_id'] or self.env.company,
                     'record': record,
                 }
-                body = template.render(template_ctx, engine='ir.qweb', minimal_qcontext=True)
+                body = template._render(template_ctx, engine='ir.qweb', minimal_qcontext=True)
                 values['body_html'] = self.env['mail.render.mixin']._replace_local_links(body)
         mail = self.env['mail.mail'].sudo().create(values)