[IMP] website_event: avoid reading of emails

The new route make_event_ics_file received a list of attendee ids and was sending
the emails associated with these in an ics file, this could potentially
give out some information about the attendees.

(see commit 7862b2b71cab2f2e86439fee9483b972a51783f6)

Also the method get_ics_file had no reason to be public and so is now
private.

Closes #24711

1 files changed, 4 insertions, 5 deletions

diff --git a/addons/website_event/controllers/main.py b/addons/website_event/controllers/main.py
index d6e03931722..a06d9500233 100644
--- a/addons/website_event/controllers/main.py
+++ b/addons/website_event/controllers/main.py
@@ -10,7 +10,7 @@ from dateutil.relativedelta import relativedelta
 
 from odoo import fields, http, _
 from odoo.addons.http_routing.models.ir_http import slug
-from odoo.http import request
+from odoo.http import content_disposition, request
 
 
 class WebsiteEventController(http.Controller):
@@ -270,15 +270,14 @@ class WebsiteEventController(http.Controller):
             'iCal_url': urls.get('iCal_url')
         })
 
-    @http.route(['/event/<model("event.event"):event>/ics/<string:name>.ics'], type='http', auth="public", website=True)
+    @http.route(['/event/<model("event.event"):event>/ics'], type='http', auth="public", website=True)
     def make_event_ics_file(self, event, **kwargs):
         if not event or not event.registration_ids:
             return request.not_found()
-        attendee_ids = list(json.loads(kwargs.get('attendees', '{}').replace("'", '"')).values())
-        files = event.get_ics_file(attendee_ids)
+        files = event._get_ics_file()
         content = files[event.id]
         return request.make_response(content, [
             ('Content-Type', 'application/octet-stream'),
             ('Content-Length', len(content)),
-            ('Content-Disposition', 'attachment; filename=' + event.name + '.ics')
+            ('Content-Disposition', content_disposition('%s.ics' % event.name))
         ])