[IMP] *: convert to private methods

render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id

Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.

7 files changed, 17 insertions, 17 deletions

diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index 93d44718b9b..bbbb0c5960b 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -167,15 +167,15 @@ class Website(Home):
             sitemaps.unlink()
 
             pages = 0
-            locs = request.website.with_user(request.website.user_id).enumerate_pages()
+            locs = request.website.with_user(request.website.user_id)._enumerate_pages()
             while True:
                 values = {
                     'locs': islice(locs, 0, LOC_PER_SITEMAP),
                     'url_root': request.httprequest.url_root[:-1],
                 }
-                urls = View.render_template('website.sitemap_locs', values)
+                urls = View._render_template('website.sitemap_locs', values)
                 if urls.strip():
-                    content = View.render_template('website.sitemap_xml', {'content': urls})
+                    content = View._render_template('website.sitemap_xml', {'content': urls})
                     pages += 1
                     last_sitemap = create_sitemap('/sitemap-%d-%d.xml' % (current_website.id, pages), content)
                 else:
@@ -194,7 +194,7 @@ class Website(Home):
                 pages_with_website = ["%d-%d" % (current_website.id, p) for p in range(1, pages + 1)]
 
                 # Sitemaps must be split in several smaller files with a sitemap index
-                content = View.render_template('website.sitemap_index_xml', {
+                content = View._render_template('website.sitemap_index_xml', {
                     'pages': pages_with_website,
                     'url_root': request.httprequest.url_root,
                 })
@@ -238,7 +238,7 @@ class Website(Home):
         matching_urls = set(map(lambda match: match['value'], matching_pages))
 
         matching_last_modified = []
-        last_modified_pages = current_website.get_website_pages(order='write_date desc', limit=5)
+        last_modified_pages = current_website._get_website_pages(order='write_date desc', limit=5)
         for url, name in last_modified_pages.mapped(lambda p: (p.url, p.name)):
             if needle.lower() in name.lower() or needle.lower() in url.lower() and url not in matching_urls:
                 matching_last_modified.append({
@@ -474,7 +474,7 @@ class Website(Home):
         View = request.env['ir.ui.view']
         res = {}
         for id_or_xml_id in ids_or_xml_ids:
-            res[id_or_xml_id] = View.render_template(id_or_xml_id, values)
+            res[id_or_xml_id] = View._render_template(id_or_xml_id, values)
         return res
 
     @http.route(['/website/update_visitor_timezone'], type='json', auth="public", website=True)
diff --git a/addons/website/models/ir_http.py b/addons/website/models/ir_http.py
index 2e6aa532f88..25826241f2b 100644
--- a/addons/website/models/ir_http.py
+++ b/addons/website/models/ir_http.py
@@ -323,7 +323,7 @@ class Http(models.AbstractModel):
     @classmethod
     def _get_error_html(cls, env, code, values):
         if code in ('page_404', 'protected_403'):
-            return code.split('_')[1], env['ir.ui.view'].render_template('website.%s' % code, values)
+            return code.split('_')[1], env['ir.ui.view']._render_template('website.%s' % code, values)
         return super(Http, cls)._get_error_html(env, code, values)
 
     def binary_content(self, xmlid=None, model='ir.attachment', id=None, field='datas',
diff --git a/addons/website/models/ir_ui_view.py b/addons/website/models/ir_ui_view.py
index 12d2831c0d8..8fa24631d26 100644
--- a/addons/website/models/ir_ui_view.py
+++ b/addons/website/models/ir_ui_view.py
@@ -384,7 +384,7 @@ class View(models.Model):
                 return False
         return True
 
-    def render(self, values=None, engine='ir.qweb', minimal_qcontext=False):
+    def _render(self, values=None, engine='ir.qweb', minimal_qcontext=False):
         """ Render the template. If website is enabled on request, then extend rendering context with website values. """
         self._handle_visibility(do_raise=True)
         new_context = dict(self._context)
@@ -411,7 +411,7 @@ class View(models.Model):
 
         if self._context != new_context:
             self = self.with_context(new_context)
-        return super(View, self).render(values, engine=engine, minimal_qcontext=minimal_qcontext)
+        return super(View, self)._render(values, engine=engine, minimal_qcontext=minimal_qcontext)
 
     @api.model
     def _prepare_qcontext(self):
diff --git a/addons/website/models/website.py b/addons/website/models/website.py
index c0c65070311..e6c86ed3f3f 100644
--- a/addons/website/models/website.py
+++ b/addons/website/models/website.py
@@ -760,7 +760,7 @@ class Website(models.Model):
         return all(p.name in rule._converters for p in params
                    if p.kind in supported_kinds and has_no_default(p))
 
-    def enumerate_pages(self, query_string=None, force=False):
+    def _enumerate_pages(self, query_string=None, force=False):
         """ Available pages in the website/CMS. This is mostly used for links
             generation and can be overridden by modules setting up new HTML
             controllers for dynamic pages (e.g. blog).
@@ -850,7 +850,7 @@ class Website(models.Model):
         if query_string:
             domain += [('url', 'like', query_string)]
 
-        pages = self.get_website_pages(domain)
+        pages = self._get_website_pages(domain)
 
         for page in pages:
             record = {'loc': page['url'], 'id': page['id'], 'name': page['name']}
@@ -860,7 +860,7 @@ class Website(models.Model):
                 record['lastmod'] = page['write_date'].date()
             yield record
 
-    def get_website_pages(self, domain=[], order='name', limit=None):
+    def _get_website_pages(self, domain=[], order='name', limit=None):
         domain += self.get_current_website().website_domain()
         pages = self.env['website.page'].sudo().search(domain, order=order, limit=limit)
         return pages
@@ -868,7 +868,7 @@ class Website(models.Model):
     def search_pages(self, needle=None, limit=None):
         name = slugify(needle, max_length=50, path=True)
         res = []
-        for page in self.enumerate_pages(query_string=name, force=True):
+        for page in self._enumerate_pages(query_string=name, force=True):
             res.append(page)
             if len(res) == limit:
                 break
diff --git a/addons/website/models/website_menu.py b/addons/website/models/website_menu.py
index 74117b11711..afd728ca9b0 100644
--- a/addons/website/models/website_menu.py
+++ b/addons/website/models/website_menu.py
@@ -25,7 +25,7 @@ class Menu(models.Model):
         for menu in self:
             if menu.is_mega_menu:
                 if not menu.mega_menu_content:
-                    default_content = self.env['ir.ui.view'].render_template('website.s_mega_menu_multi_menus')
+                    default_content = self.env['ir.ui.view']._render_template('website.s_mega_menu_multi_menus')
                     menu.mega_menu_content = default_content.decode()
             else:
                 menu.mega_menu_content = False
diff --git a/addons/website/tests/test_qweb.py b/addons/website/tests/test_qweb.py
index 99f53078310..7b7d08ded8d 100644
--- a/addons/website/tests/test_qweb.py
+++ b/addons/website/tests/test_qweb.py
@@ -32,7 +32,7 @@ class TestQweb(TransactionCaseWithUserDemo):
 
         demo_env = self.env(user=demo)
 
-        html = demo_env['ir.qweb'].render('website.test_template', {"user": demo}, website_id= website.id)
+        html = demo_env['ir.qweb']._render('website.test_template', {"user": demo}, website_id= website.id)
         html = html.strip().decode('utf8')
         html = re.sub(r'\?unique=[^"]+', '', html).encode('utf8')
 
diff --git a/addons/website/tests/test_views.py b/addons/website/tests/test_views.py
index 9f19cdcc303..c662416756c 100644
--- a/addons/website/tests/test_views.py
+++ b/addons/website/tests/test_views.py
@@ -204,7 +204,7 @@ class TestViewSaving(common.TransactionCase):
         )
         self.assertIn(
             replacement,
-            view.render().decode('utf-8'),
+            view._render().decode('utf-8'),
             'inline script should not be escaped when rendering'
         )
         # common text nodes should be be escaped client side
@@ -213,7 +213,7 @@ class TestViewSaving(common.TransactionCase):
         self.assertIn(replacement, view.arch, 'common text node should not be escaped server side')
         self.assertIn(
             replacement,
-            view.render().decode('utf-8').replace(u'&', u'&'),
+            view._render().decode('utf-8').replace(u'&', u'&'),
             'text node characters wrongly unescaped when rendering'
         )