[IMP] *: convert to private methods

render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id

Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.

1 files changed, 2 insertions, 2 deletions

diff --git a/addons/web_editor/models/ir_ui_view.py b/addons/web_editor/models/ir_ui_view.py
index 1e47c1800f9..c56fdadbb6e 100644
--- a/addons/web_editor/models/ir_ui_view.py
+++ b/addons/web_editor/models/ir_ui_view.py
@@ -15,7 +15,7 @@ _logger = logging.getLogger(__name__)
 class IrUiView(models.Model):
     _inherit = 'ir.ui.view'
 
-    def render(self, values=None, engine='ir.qweb', minimal_qcontext=False):
+    def _render(self, values=None, engine='ir.qweb', minimal_qcontext=False):
         if values and values.get('editable'):
             try:
                 self.check_access_rights('write')
@@ -23,7 +23,7 @@ class IrUiView(models.Model):
             except AccessError:
                 values['editable'] = False
 
-        return super(IrUiView, self).render(values=values, engine=engine, minimal_qcontext=minimal_qcontext)
+        return super(IrUiView, self)._render(values=values, engine=engine, minimal_qcontext=minimal_qcontext)
 
     #------------------------------------------------------
     # Save from html