[IMP] *: convert to private methods

render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id

Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.

4 files changed, 8 insertions, 8 deletions

diff --git a/addons/website/models/ir_http.py b/addons/website/models/ir_http.py
index 2e6aa532f88..25826241f2b 100644
--- a/addons/website/models/ir_http.py
+++ b/addons/website/models/ir_http.py
@@ -323,7 +323,7 @@ class Http(models.AbstractModel):
     @classmethod
     def _get_error_html(cls, env, code, values):
         if code in ('page_404', 'protected_403'):
-            return code.split('_')[1], env['ir.ui.view'].render_template('website.%s' % code, values)
+            return code.split('_')[1], env['ir.ui.view']._render_template('website.%s' % code, values)
         return super(Http, cls)._get_error_html(env, code, values)
 
     def binary_content(self, xmlid=None, model='ir.attachment', id=None, field='datas',
diff --git a/addons/website/models/ir_ui_view.py b/addons/website/models/ir_ui_view.py
index 12d2831c0d8..8fa24631d26 100644
--- a/addons/website/models/ir_ui_view.py
+++ b/addons/website/models/ir_ui_view.py
@@ -384,7 +384,7 @@ class View(models.Model):
                 return False
         return True
 
-    def render(self, values=None, engine='ir.qweb', minimal_qcontext=False):
+    def _render(self, values=None, engine='ir.qweb', minimal_qcontext=False):
         """ Render the template. If website is enabled on request, then extend rendering context with website values. """
         self._handle_visibility(do_raise=True)
         new_context = dict(self._context)
@@ -411,7 +411,7 @@ class View(models.Model):
 
         if self._context != new_context:
             self = self.with_context(new_context)
-        return super(View, self).render(values, engine=engine, minimal_qcontext=minimal_qcontext)
+        return super(View, self)._render(values, engine=engine, minimal_qcontext=minimal_qcontext)
 
     @api.model
     def _prepare_qcontext(self):
diff --git a/addons/website/models/website.py b/addons/website/models/website.py
index c0c65070311..e6c86ed3f3f 100644
--- a/addons/website/models/website.py
+++ b/addons/website/models/website.py
@@ -760,7 +760,7 @@ class Website(models.Model):
         return all(p.name in rule._converters for p in params
                    if p.kind in supported_kinds and has_no_default(p))
 
-    def enumerate_pages(self, query_string=None, force=False):
+    def _enumerate_pages(self, query_string=None, force=False):
         """ Available pages in the website/CMS. This is mostly used for links
             generation and can be overridden by modules setting up new HTML
             controllers for dynamic pages (e.g. blog).
@@ -850,7 +850,7 @@ class Website(models.Model):
         if query_string:
             domain += [('url', 'like', query_string)]
 
-        pages = self.get_website_pages(domain)
+        pages = self._get_website_pages(domain)
 
         for page in pages:
             record = {'loc': page['url'], 'id': page['id'], 'name': page['name']}
@@ -860,7 +860,7 @@ class Website(models.Model):
                 record['lastmod'] = page['write_date'].date()
             yield record
 
-    def get_website_pages(self, domain=[], order='name', limit=None):
+    def _get_website_pages(self, domain=[], order='name', limit=None):
         domain += self.get_current_website().website_domain()
         pages = self.env['website.page'].sudo().search(domain, order=order, limit=limit)
         return pages
@@ -868,7 +868,7 @@ class Website(models.Model):
     def search_pages(self, needle=None, limit=None):
         name = slugify(needle, max_length=50, path=True)
         res = []
-        for page in self.enumerate_pages(query_string=name, force=True):
+        for page in self._enumerate_pages(query_string=name, force=True):
             res.append(page)
             if len(res) == limit:
                 break
diff --git a/addons/website/models/website_menu.py b/addons/website/models/website_menu.py
index 74117b11711..afd728ca9b0 100644
--- a/addons/website/models/website_menu.py
+++ b/addons/website/models/website_menu.py
@@ -25,7 +25,7 @@ class Menu(models.Model):
         for menu in self:
             if menu.is_mega_menu:
                 if not menu.mega_menu_content:
-                    default_content = self.env['ir.ui.view'].render_template('website.s_mega_menu_multi_menus')
+                    default_content = self.env['ir.ui.view']._render_template('website.s_mega_menu_multi_menus')
                     menu.mega_menu_content = default_content.decode()
             else:
                 menu.mega_menu_content = False