[FIX] web, web_editor: allow editor instantiation from public user

If for some reason someone wanted to develop a textarea using the
editor which is supposed to work as a public user (like we are trying
to do on Odoo.com), it was not possible. The code was "designed" to
allow it but there was one problem: the lazy loading of the editor
assets required a `render_template` call to the server... which cannot
be done from a public user.

This commit solves the issues by allowing the lazy loading of assets
to use a custom route if required. That route is then used by the editor
"root". That route performs the render_template as a superuser provided
that the view's xmlid is whitelisted.

Note: there was another unauthorized call for public user: the
colorpicker. This was solved by disabling the colorpicker template rpc
for public user, they will still get the default summernote one.

Part of https://github.com/odoo/odoo/pull/48981

closes odoo/odoo#48981

closes odoo/odoo#49398

X-original-commit: e84a0bfdc99c21406861b88c02b11c925d92f927
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>

1 files changed, 3 insertions, 2 deletions

diff --git a/addons/web/static/src/js/services/ajax_service.js b/addons/web/static/src/js/services/ajax_service.js
index f2fc3436991..da3d436c395 100644
--- a/addons/web/static/src/js/services/ajax_service.js
+++ b/addons/web/static/src/js/services/ajax_service.js
@@ -10,9 +10,10 @@ var AjaxService = AbstractService.extend({
     /**
      * @param {Object} libs - @see ajax.loadLibs
      * @param {Object} [context] - @see ajax.loadLibs
+     * @param {Object} [tplRoute] - @see ajax.loadLibs
      */
-    loadLibs: function (libs, context) {
-        return ajax.loadLibs(libs, context);
+    loadLibs: function (libs, context, tplRoute) {
+        return ajax.loadLibs(libs, context, tplRoute);
     },
     rpc: function (route, args, options, target) {
         var rpcPromise;