[IMP] *: convert to private methods

render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id

Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.

3 files changed, 9 insertions, 9 deletions

diff --git a/addons/survey/controllers/main.py b/addons/survey/controllers/main.py
index 0d0a32ee9a2..b55ea0e1277 100644
--- a/addons/survey/controllers/main.py
+++ b/addons/survey/controllers/main.py
@@ -318,22 +318,22 @@ class Survey(http.Controller):
 
         survey_content = False
         if answer_sudo.state == 'done':
-            survey_content = request.env.ref('survey.survey_fill_form_done').render(survey_data)
+            survey_content = request.env.ref('survey.survey_fill_form_done')._render(survey_data)
         else:
-            survey_content = request.env.ref('survey.survey_fill_form_in_progress').render(survey_data)
+            survey_content = request.env.ref('survey.survey_fill_form_in_progress')._render(survey_data)
 
         survey_progress = False
         if answer_sudo.state == 'in_progress' and not survey_data.get('question', request.env['survey.question']).is_page:
             if survey_sudo.questions_layout == 'page_per_section':
                 page_ids = survey_sudo.page_ids.ids
-                survey_progress = request.env.ref('survey.survey_progression').render({
+                survey_progress = request.env.ref('survey.survey_progression')._render({
                     'survey': survey_sudo,
                     'page_ids': page_ids,
                     'page_number': page_ids.index(survey_data['page'].id) + (1 if survey_sudo.progression_mode == 'number' else 0)
                 })
             elif survey_sudo.questions_layout == 'page_per_question':
                 page_ids = survey_sudo.question_ids.ids
-                survey_progress = request.env.ref('survey.survey_progression').render({
+                survey_progress = request.env.ref('survey.survey_progression')._render({
                     'survey': survey_sudo,
                     'page_ids': page_ids,
                     'page_number': page_ids.index(survey_data['question'].id)
@@ -342,7 +342,7 @@ class Survey(http.Controller):
         return {
             'survey_content': survey_content,
             'survey_progress': survey_progress,
-            'survey_navigation': request.env.ref('survey.survey_navigation').render(survey_data),
+            'survey_navigation': request.env.ref('survey.survey_navigation')._render(survey_data),
         }
 
     @http.route('/survey/<string:survey_token>/<string:answer_token>', type='http', auth='public', website=True)
@@ -629,7 +629,7 @@ class Survey(http.Controller):
         return request.render('survey.survey_page_statistics', template_values)
 
     def _generate_report(self, user_input, download=True):
-        report = request.env.ref('survey.certification_report').sudo().render_qweb_pdf([user_input.id], data={'report_type': 'pdf'})[0]
+        report = request.env.ref('survey.certification_report').sudo()._render_qweb_pdf([user_input.id], data={'report_type': 'pdf'})[0]
 
         report_content_disposition = content_disposition('Certification.pdf')
         if not download:
diff --git a/addons/survey/controllers/survey_session_manage.py b/addons/survey/controllers/survey_session_manage.py
index e81626ce95b..090df323908 100644
--- a/addons/survey/controllers/survey_session_manage.py
+++ b/addons/survey/controllers/survey_session_manage.py
@@ -108,7 +108,7 @@ class UserInputSession(http.Controller):
 
             template_values = self._prepare_manage_session_values(survey)
             template_values['is_rpc_call'] = True
-            return request.env.ref('survey.user_input_session_manage_content').render(template_values)
+            return request.env.ref('survey.user_input_session_manage_content')._render(template_values)
         else:
             return False
 
@@ -146,7 +146,7 @@ class UserInputSession(http.Controller):
             # no open session
             return ''
 
-        return request.env.ref('survey.user_input_session_leaderboard').render({
+        return request.env.ref('survey.user_input_session_leaderboard')._render({
             'animate_width': True,
             'leaderboard': survey._prepare_leaderboard_values()
         })
diff --git a/addons/survey/wizard/survey_invite.py b/addons/survey/wizard/survey_invite.py
index b9c6759f246..0a8fba4f6af 100644
--- a/addons/survey/wizard/survey_invite.py
+++ b/addons/survey/wizard/survey_invite.py
@@ -234,7 +234,7 @@ class SurveyInvite(models.TransientModel):
                     'model_description': self.env['ir.model']._get('survey.survey').display_name,
                     'company': self.env.company,
                 }
-                body = template.render(template_ctx, engine='ir.qweb', minimal_qcontext=True)
+                body = template._render(template_ctx, engine='ir.qweb', minimal_qcontext=True)
                 mail_values['body_html'] = self.env['mail.render.mixin']._replace_local_links(body)
 
         return self.env['mail.mail'].sudo().create(mail_values)