[FIX] web, web_editor: allow editor instantiation from public user

If for some reason someone wanted to develop a textarea using the
editor which is supposed to work as a public user (like we are trying
to do on Odoo.com), it was not possible. The code was "designed" to
allow it but there was one problem: the lazy loading of the editor
assets required a `render_template` call to the server... which cannot
be done from a public user.

This commit solves the issues by allowing the lazy loading of assets
to use a custom route if required. That route is then used by the editor
"root". That route performs the render_template as a superuser provided
that the view's xmlid is whitelisted.

Note: there was another unauthorized call for public user: the
colorpicker. This was solved by disabling the colorpicker template rpc
for public user, they will still get the default summernote one.

Part of https://github.com/odoo/odoo/pull/48981

closes odoo/odoo#48981

closes odoo/odoo#49398

X-original-commit: e84a0bfdc99c21406861b88c02b11c925d92f927
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>

3 files changed, 24 insertions, 11 deletions

diff --git a/addons/web/static/src/js/core/ajax.js b/addons/web/static/src/js/core/ajax.js
index c48ae4c0254..21a0cbdc0fc 100644
--- a/addons/web/static/src/js/core/ajax.js
+++ b/addons/web/static/src/js/core/ajax.js
@@ -430,6 +430,7 @@ var loadXML = (function () {
  * @param {string} [xmlId] - the template xmlId
  * @param {Object} [context]
  *        additionnal rpc context to be merged with the default one
+ * @param {string} [tplRoute='/web/dataset/call_kw/']
  * @returns {Deferred} resolved with an object
  *          cssLibs: list of css files
  *          cssContents: list of style tag contents
@@ -439,22 +440,26 @@ var loadXML = (function () {
 var loadAsset = (function () {
     var cache = {};
 
-    var load = function loadAsset(xmlId, context) {
+    var load = function loadAsset(xmlId, context, tplRoute = '/web/dataset/call_kw/') {
         if (cache[xmlId]) {
             return cache[xmlId];
         }
         context = _.extend({}, odoo.session_info.user_context, context);
-        var params = {
+        const params = {
             args: [xmlId, {
                 debug: config.isDebug()
             }],
             kwargs: {
                 context: context,
             },
-            method: 'render_template',
-            model: 'ir.ui.view',
         };
-        cache[xmlId] = rpc('/web/dataset/call_kw/ir.ui.view/render_template', params).then(function (xml) {
+        if (tplRoute === '/web/dataset/call_kw/') {
+            Object.assign(params, {
+                model: 'ir.ui.view',
+                method: 'render_template',
+            });
+        }
+        cache[xmlId] = rpc(tplRoute, params).then(function (xml) {
             var $xml = $(xml);
             return {
                 cssLibs: $xml.filter('link[href]:not([type="image/x-icon"])').map(function () {
@@ -470,6 +475,9 @@ var loadAsset = (function () {
                     return $(this).html();
                 }).get(),
             };
+        }).guardedCatch(reason => {
+            reason.event.preventDefault();
+            throw `Unable to render the required templates for the assets to load: ${reason.message.message}`;
         });
         return cache[xmlId];
     };
@@ -504,10 +512,13 @@ var loadAsset = (function () {
  *      List of inline scripts to add after loading the JS files.
  * @param {Object} [context]
  *        additionnal rpc context to be merged with the default one
+ * @param {string} [tplRoute]
+ *      Custom route to use for template rendering of the potential assets
+ *      to load (see libs.assetLibs).
  *
  * @returns {Promise}
  */
-function loadLibs(libs, context) {
+function loadLibs(libs, context, tplRoute) {
     var mutex = new concurrency.Mutex();
     mutex.exec(function () {
         var defs = [];
@@ -530,7 +541,7 @@ function loadLibs(libs, context) {
     });
     mutex.exec(function () {
         return _loadArray(libs.assetLibs || [], function (xmlID) {
-            return ajax.loadAsset(xmlID, context).then(function (asset) {
+            return ajax.loadAsset(xmlID, context, tplRoute).then(function (asset) {
                 return ajax.loadLibs(asset);
             });
         });
diff --git a/addons/web/static/src/js/core/service_mixins.js b/addons/web/static/src/js/core/service_mixins.js
index 9e6a40b494c..d03d90456d0 100644
--- a/addons/web/static/src/js/core/service_mixins.js
+++ b/addons/web/static/src/js/core/service_mixins.js
@@ -127,10 +127,11 @@ var ServicesMixin = {
      * @private
      * @param {Object} libs - @see ajax.loadLibs
      * @param {Object} [context] - @see ajax.loadLibs
+     * @param {Object} [tplRoute=this._loadLibsTplRoute] - @see ajax.loadLibs
      * @returns {Promise}
      */
-    _loadLibs: function (libs, context) {
-        return this.call('ajax', 'loadLibs', libs, context);
+    _loadLibs: function (libs, context, tplRoute) {
+        return this.call('ajax', 'loadLibs', libs, context, tplRoute || this._loadLibsTplRoute);
     },
     /**
      * Builds and executes RPC query. Returns a promise resolved with
diff --git a/addons/web/static/src/js/services/ajax_service.js b/addons/web/static/src/js/services/ajax_service.js
index f2fc3436991..da3d436c395 100644
--- a/addons/web/static/src/js/services/ajax_service.js
+++ b/addons/web/static/src/js/services/ajax_service.js
@@ -10,9 +10,10 @@ var AjaxService = AbstractService.extend({
     /**
      * @param {Object} libs - @see ajax.loadLibs
      * @param {Object} [context] - @see ajax.loadLibs
+     * @param {Object} [tplRoute] - @see ajax.loadLibs
      */
-    loadLibs: function (libs, context) {
-        return ajax.loadLibs(libs, context);
+    loadLibs: function (libs, context, tplRoute) {
+        return ajax.loadLibs(libs, context, tplRoute);
     },
     rpc: function (route, args, options, target) {
         var rpcPromise;