[IMP] *: convert to private methods

render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id

Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.

5 files changed, 7 insertions, 7 deletions

diff --git a/addons/web_editor/controllers/main.py b/addons/web_editor/controllers/main.py
index 488c203d35f..cd8ade0f108 100644
--- a/addons/web_editor/controllers/main.py
+++ b/addons/web_editor/controllers/main.py
@@ -476,4 +476,4 @@ class Web_Editor(http.Controller):
         if request.env.user._is_public() \
                 and xmlid in request.env['web_editor.assets']._get_public_asset_xmlids():
             View = View.sudo()
-        return View.render_template(xmlid, {k: values[k] for k in values if k in trusted_value_keys})
+        return View._render_template(xmlid, {k: values[k] for k in values if k in trusted_value_keys})
diff --git a/addons/web_editor/models/ir_ui_view.py b/addons/web_editor/models/ir_ui_view.py
index 1e47c1800f9..c56fdadbb6e 100644
--- a/addons/web_editor/models/ir_ui_view.py
+++ b/addons/web_editor/models/ir_ui_view.py
@@ -15,7 +15,7 @@ _logger = logging.getLogger(__name__)
 class IrUiView(models.Model):
     _inherit = 'ir.ui.view'
 
-    def render(self, values=None, engine='ir.qweb', minimal_qcontext=False):
+    def _render(self, values=None, engine='ir.qweb', minimal_qcontext=False):
         if values and values.get('editable'):
             try:
                 self.check_access_rights('write')
@@ -23,7 +23,7 @@ class IrUiView(models.Model):
             except AccessError:
                 values['editable'] = False
 
-        return super(IrUiView, self).render(values=values, engine=engine, minimal_qcontext=minimal_qcontext)
+        return super(IrUiView, self)._render(values=values, engine=engine, minimal_qcontext=minimal_qcontext)
 
     #------------------------------------------------------
     # Save from html
diff --git a/addons/web_editor/static/src/js/editor/snippets.editor.js b/addons/web_editor/static/src/js/editor/snippets.editor.js
index 69baddaefe4..9b0b5ed2e7f 100644
--- a/addons/web_editor/static/src/js/editor/snippets.editor.js
+++ b/addons/web_editor/static/src/js/editor/snippets.editor.js
@@ -1034,7 +1034,7 @@ var SnippetsMenu = Widget.extend({
         }
         this._defLoadSnippets = this._rpc({
             model: 'ir.ui.view',
-            method: 'render_template',
+            method: 'render_public_asset',
             args: [this.options.snippets, {}],
             kwargs: {
                 context: this.options.context,
diff --git a/addons/web_editor/static/tests/test_utils.js b/addons/web_editor/static/tests/test_utils.js
index fcbf52f2521..b8dd9040fc7 100644
--- a/addons/web_editor/static/tests/test_utils.js
+++ b/addons/web_editor/static/tests/test_utils.js
@@ -98,7 +98,7 @@ MockServer.include({
             if (args.method === 'read_template' && args.args[0] === "web_editor.colorpicker") {
                 return COLOR_PICKER_TEMPLATE;
             }
-            if (args.method === 'render_template' && args.args[0] === "web_editor.snippets") {
+            if (args.method === 'render_public_asset' && args.args[0] === "web_editor.snippets") {
                 return SNIPPETS_TEMPLATE;
             }
         }
diff --git a/addons/web_editor/tests/test_converter.py b/addons/web_editor/tests/test_converter.py
index 724b464368b..3d9259ba5b5 100644
--- a/addons/web_editor/tests/test_converter.py
+++ b/addons/web_editor/tests/test_converter.py
@@ -129,7 +129,7 @@ class TestConvertBack(common.TransactionCase):
         field_value = 'record.%s' % field
         e.set('t-field', field_value)
 
-        rendered = self.env['ir.qweb'].render(t, {'record': record})
+        rendered = self.env['ir.qweb']._render(t, {'record': record})
 
         element = html.fromstring(rendered, parser=html.HTMLParser(encoding='utf-8'))
         model = 'ir.qweb.field.' + element.get('data-oe-type', '')
@@ -197,7 +197,7 @@ class TestConvertBack(common.TransactionCase):
         field_value = 'record.%s' % field
         e.set('t-field', field_value)
 
-        rendered = self.env['ir.qweb'].render(t, {'record': record})
+        rendered = self.env['ir.qweb']._render(t, {'record': record})
         element = html.fromstring(rendered, parser=html.HTMLParser(encoding='utf-8'))
 
         # emulate edition