[IMP] *: convert to private methods

render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id

Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.

6 files changed, 13 insertions, 13 deletions

diff --git a/addons/mail/models/mail_activity.py b/addons/mail/models/mail_activity.py
index 827dcc5e33e..0822c3adb06 100644
--- a/addons/mail/models/mail_activity.py
+++ b/addons/mail/models/mail_activity.py
@@ -393,7 +393,7 @@ class MailActivity(models.Model):
                 body_template = body_template.with_context(lang=activity.user_id.lang)
                 activity = activity.with_context(lang=activity.user_id.lang)
             model_description = self.env['ir.model']._get(activity.res_model).display_name
-            body = body_template.render(
+            body = body_template._render(
                 dict(
                     activity=activity,
                     model_description=model_description,
@@ -798,7 +798,7 @@ class MailActivityMixin(models.AbstractModel):
             activities |= self.env['mail.activity'].create(create_vals)
         return activities
 
-    def activity_schedule_with_view(self, act_type_xmlid='', date_deadline=None, summary='', views_or_xmlid='', render_context=None, **act_values):
+    def _activity_schedule_with_view(self, act_type_xmlid='', date_deadline=None, summary='', views_or_xmlid='', render_context=None, **act_values):
         """ Helper method: Schedule an activity on each record of the current record set.
         This method allow to the same mecanism as `activity_schedule`, but provide
         2 additionnal parameters:
@@ -821,7 +821,7 @@ class MailActivityMixin(models.AbstractModel):
         activities = self.env['mail.activity']
         for record in self:
             render_context['object'] = record
-            note = views.render(render_context, engine='ir.qweb', minimal_qcontext=True)
+            note = views._render(render_context, engine='ir.qweb', minimal_qcontext=True)
             activities |= record.activity_schedule(act_type_xmlid=act_type_xmlid, date_deadline=date_deadline, summary=summary, note=note, **act_values)
         return activities
 
diff --git a/addons/mail/models/mail_alias.py b/addons/mail/models/mail_alias.py
index e66cf303b98..22ef164966c 100644
--- a/addons/mail/models/mail_alias.py
+++ b/addons/mail/models/mail_alias.py
@@ -182,7 +182,7 @@ Only allowed people can contact us at this address.""" % message_dict.get('to'))
         else:
             body = self._get_alias_bounced_body_fallback(message_dict)
         template = self.env.ref('mail.mail_bounce_alias_security', raise_if_not_found=True)
-        return template.render({
+        return template._render({
             'body': body,
             'message': message_dict
         }, engine='ir.qweb', minimal_qcontext=True)
diff --git a/addons/mail/models/mail_channel.py b/addons/mail/models/mail_channel.py
index 590a598e727..5d9d988d9dc 100644
--- a/addons/mail/models/mail_channel.py
+++ b/addons/mail/models/mail_channel.py
@@ -426,7 +426,7 @@ class Channel(models.Model):
             create_values = {
                 'email_from': company.catchall_formatted or company.email_formatted,
                 'author_id': self.env.user.partner_id.id,
-                'body_html': view.render({'channel': self, 'partner': partner}, engine='ir.qweb', minimal_qcontext=True),
+                'body_html': view._render({'channel': self, 'partner': partner}, engine='ir.qweb', minimal_qcontext=True),
                 'subject': _("Guidelines of channel %s") % self.name,
                 'recipient_ids': [(4, partner.id)]
             }
diff --git a/addons/mail/models/mail_message.py b/addons/mail/models/mail_message.py
index bddbcb91b98..733ff7d7f4c 100644
--- a/addons/mail/models/mail_message.py
+++ b/addons/mail/models/mail_message.py
@@ -935,7 +935,7 @@ class Message(models.Model):
             MailThread.message_notify(
                 partner_ids=moderator.partner_id.ids,
                 subject=_('Message are pending moderation'),  # tocheck: target language
-                body=template.render({'record': moderator.partner_id}, engine='ir.qweb', minimal_qcontext=True),
+                body=template._render({'record': moderator.partner_id}, engine='ir.qweb', minimal_qcontext=True),
                 email_from=moderator.company_id.catchall_formatted or moderator.company_id.email_formatted,
             )
 
diff --git a/addons/mail/models/mail_template.py b/addons/mail/models/mail_template.py
index c4d590e2729..f8f90aea5fd 100644
--- a/addons/mail/models/mail_template.py
+++ b/addons/mail/models/mail_template.py
@@ -196,9 +196,9 @@ class MailTemplate(models.Model):
                     report_service = report.report_name
 
                     if report.report_type in ['qweb-html', 'qweb-pdf']:
-                        result, format = report.render_qweb_pdf([res_id])
+                        result, format = report._render_qweb_pdf([res_id])
                     else:
-                        res = report.render([res_id])
+                        res = report._render([res_id])
                         if not res:
                             raise UserError(_('Unsupported report type %s found.') % report.report_type)
                         result, format = res
@@ -267,7 +267,7 @@ class MailTemplate(models.Model):
                     'company': 'company_id' in record and record['company_id'] or self.env.company,
                     'record': record,
                 }
-                body = template.render(template_ctx, engine='ir.qweb', minimal_qcontext=True)
+                body = template._render(template_ctx, engine='ir.qweb', minimal_qcontext=True)
                 values['body_html'] = self.env['mail.render.mixin']._replace_local_links(body)
         mail = self.env['mail.mail'].sudo().create(values)
 
diff --git a/addons/mail/models/mail_thread.py b/addons/mail/models/mail_thread.py
index 77623b08ff7..349396ee0a4 100644
--- a/addons/mail/models/mail_thread.py
+++ b/addons/mail/models/mail_thread.py
@@ -1015,7 +1015,7 @@ class MailThread(models.AbstractModel):
             # check it does not directly contact catchall
             if catchall_alias and all(email_localpart == catchall_alias for email_localpart in email_to_localparts):
                 _logger.info('Routing mail from %s to %s with Message-Id %s: direct write to catchall, bounce', email_from, email_to, message_id)
-                body = self.env.ref('mail.mail_bounce_catchall').render({
+                body = self.env.ref('mail.mail_bounce_catchall')._render({
                     'message': message,
                 }, engine='ir.qweb')
                 self._routing_create_bounce_email(email_from, body, message, references=message_id, reply_to=self.env.company.email)
@@ -1968,7 +1968,7 @@ class MailThread(models.AbstractModel):
             return
         for record in self:
             values['object'] = record
-            rendered_template = views.render(values, engine='ir.qweb', minimal_qcontext=True)
+            rendered_template = views._render(values, engine='ir.qweb', minimal_qcontext=True)
             kwargs['body'] = rendered_template
             record.message_post_with_template(False, **kwargs)
 
@@ -2294,7 +2294,7 @@ class MailThread(models.AbstractModel):
             # {actions, button_access, has_button_access, recipients}
 
             if base_template:
-                mail_body = base_template.render(render_values, engine='ir.qweb', minimal_qcontext=True)
+                mail_body = base_template._render(render_values, engine='ir.qweb', minimal_qcontext=True)
             else:
                 mail_body = message.body
             mail_body = self.env['mail.render.mixin']._replace_local_links(mail_body)
@@ -2886,7 +2886,7 @@ class MailThread(models.AbstractModel):
                 'model_description': model_description,
                 'access_link': self._notify_get_action_link('view'),
             }
-            assignation_msg = view.render(values, engine='ir.qweb', minimal_qcontext=True)
+            assignation_msg = view._render(values, engine='ir.qweb', minimal_qcontext=True)
             assignation_msg = self.env['mail.render.mixin']._replace_local_links(assignation_msg)
             record.message_notify(
                 subject=_('You have been assigned to %s') % record.display_name,