diff options
| author | Benoit Socias <bso@odoo.com> | 2021-01-06 10:12:07 +0000 |
|---|---|---|
| committer | qsm-odoo <qsm@odoo.com> | 2021-01-06 14:17:21 +0000 |
| commit | 3fd40ba2030fef7dccf4046a932e3b3a172dc53f (patch) | |
| tree | 4c1f8ce147358ee165a1b5bf163838353288b0c1 /addons/web_editor/models | |
| parent | 0de069b8ca9fb005ba5b076984f5677de25889ee (diff) | |
[FIX] web_editor, *: review `public_render_template`
*: website, base
The normal flow to render a template is now to use `render_public_asset`
which bypasses the read access rights if the user matches the groups
the view declares.
For public users, we still cannot use that as they do not have access
to calling model methods at all. The route `public_render_template` is
thus still needed, but it should use the `render_public_asset` util. In
master, it will only rely on it but as a stable fix, we still need to
use the whitelist as we cannot change the related views' group.
This commit also adds deprecated comments to the read_template method
which has been removed in master.
Related to task-2412544
closes odoo/odoo#64137
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Diffstat (limited to 'addons/web_editor/models')
| -rw-r--r-- | addons/web_editor/models/ir_ui_view.py | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/addons/web_editor/models/ir_ui_view.py b/addons/web_editor/models/ir_ui_view.py index 4faa9ef0474..e7fe4b3617d 100644 --- a/addons/web_editor/models/ir_ui_view.py +++ b/addons/web_editor/models/ir_ui_view.py @@ -29,6 +29,8 @@ class IrUiView(models.Model): @api.model def read_template(self, xml_id): + """ This method is deprecated + """ if xml_id == 'web_editor.colorpicker' and self.env.user.has_group('base.group_user'): # TODO this should be handled another way but was required as a # stable fix in 14.0. The views are now private by default: they |