diff options
| author | Martin Trigaux <mat@odoo.com> | 2020-02-14 11:22:15 +0100 |
|---|---|---|
| committer | Martin Trigaux <mat@odoo.com> | 2020-05-14 13:59:10 +0200 |
| commit | d9287caf9408bb4ff85ad734cbca08e44321e205 (patch) | |
| tree | 0d3b7c5705e5172176a7d76bf9098e381190bf4b /addons/web | |
| parent | 56a8c9e4311d24c33b7ad08b8230e4be345a85b8 (diff) | |
[IMP] *: convert to private methods
render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id
Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.
Diffstat (limited to 'addons/web')
| -rw-r--r-- | addons/web/controllers/main.py | 6 | ||||
| -rw-r--r-- | addons/web/models/models.py | 4 | ||||
| -rw-r--r-- | addons/web/static/src/js/core/ajax.js | 2 |
3 files changed, 6 insertions, 6 deletions
diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index c68966af4bc..971181d14a1 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -1974,14 +1974,14 @@ class ReportController(http.Controller): del data['context']['lang'] context.update(data['context']) if converter == 'html': - html = report.with_context(context).render_qweb_html(docids, data=data)[0] + html = report.with_context(context)._render_qweb_html(docids, data=data)[0] return request.make_response(html) elif converter == 'pdf': - pdf = report.with_context(context).render_qweb_pdf(docids, data=data)[0] + pdf = report.with_context(context)._render_qweb_pdf(docids, data=data)[0] pdfhttpheaders = [('Content-Type', 'application/pdf'), ('Content-Length', len(pdf))] return request.make_response(pdf, headers=pdfhttpheaders) elif converter == 'text': - text = report.with_context(context).render_qweb_text(docids, data=data)[0] + text = report.with_context(context)._render_qweb_text(docids, data=data)[0] texthttpheaders = [('Content-Type', 'text/plain'), ('Content-Length', len(text))] return request.make_response(text, headers=texthttpheaders) else: diff --git a/addons/web/models/models.py b/addons/web/models/models.py index 2e8d63b55be..348fecb8cb1 100644 --- a/addons/web/models/models.py +++ b/addons/web/models/models.py @@ -192,7 +192,7 @@ class Base(models.AbstractModel): @api.model def qweb_render_view(self, view_id, domain): assert view_id - return self.env['ir.qweb'].render( + return self.env['ir.qweb']._render( view_id, { **self.env['ir.ui.view']._prepare_qcontext(), **self._qweb_prepare_qcontext(view_id, domain), @@ -526,7 +526,7 @@ class ResCompany(models.Model): # One bundle for everyone, so this method # necessarily updates the style for every company at once company_ids = self.sudo().search([]) - company_styles = template_style.render({ + company_styles = template_style._render({ 'company_ids': company_ids, }) return base64.b64encode((company_styles)) diff --git a/addons/web/static/src/js/core/ajax.js b/addons/web/static/src/js/core/ajax.js index 21a0cbdc0fc..ae3194e2a45 100644 --- a/addons/web/static/src/js/core/ajax.js +++ b/addons/web/static/src/js/core/ajax.js @@ -456,7 +456,7 @@ var loadAsset = (function () { if (tplRoute === '/web/dataset/call_kw/') { Object.assign(params, { model: 'ir.ui.view', - method: 'render_template', + method: 'render_public_asset', }); } cache[xmlId] = rpc(tplRoute, params).then(function (xml) { |