[IMP] *: convert to private methods

render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id

Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.

2 files changed, 6 insertions, 6 deletions

diff --git a/addons/website_sale/controllers/main.py b/addons/website_sale/controllers/main.py
index 113e22e435c..ee86c8369fb 100644
--- a/addons/website_sale/controllers/main.py
+++ b/addons/website_sale/controllers/main.py
@@ -466,12 +466,12 @@ class WebsiteSale(http.Controller):
         if not display:
             return value
 
-        value['website_sale.cart_lines'] = request.env['ir.ui.view'].render_template("website_sale.cart_lines", {
+        value['website_sale.cart_lines'] = request.env['ir.ui.view']._render_template("website_sale.cart_lines", {
             'website_sale_order': order,
             'date': fields.Date.today(),
             'suggested_products': order._cart_accessories()
         })
-        value['website_sale.short_cart_summary'] = request.env['ir.ui.view'].render_template("website_sale.short_cart_summary", {
+        value['website_sale.short_cart_summary'] = request.env['ir.ui.view']._render_template("website_sale.short_cart_summary", {
             'website_sale_order': order,
         })
         return value
@@ -960,7 +960,7 @@ class WebsiteSale(http.Controller):
 
         return {
             'recall': order.get_portal_last_transaction().state == 'pending',
-            'message': request.env['ir.ui.view'].render_template("website_sale.payment_confirmation_status", {
+            'message': request.env['ir.ui.view']._render_template("website_sale.payment_confirmation_status", {
                 'order': order
             })
         }
@@ -1025,7 +1025,7 @@ class WebsiteSale(http.Controller):
     def print_saleorder(self, **kwargs):
         sale_order_id = request.session.get('sale_last_order_id')
         if sale_order_id:
-            pdf, _ = request.env.ref('sale.action_report_saleorder').sudo().render_qweb_pdf([sale_order_id])
+            pdf, _ = request.env.ref('sale.action_report_saleorder').sudo()._render_qweb_pdf([sale_order_id])
             pdfhttpheaders = [('Content-Type', 'application/pdf'), ('Content-Length', u'%s' % len(pdf))]
             return request.make_response(pdf, headers=pdfhttpheaders)
         else:
@@ -1243,7 +1243,7 @@ class WebsiteSale(http.Controller):
                     res_product.update(combination_info)
                     res_product['price'] = FieldMonetary.value_to_html(res_product['price'], monetary_options)
                     if rating:
-                        res_product['rating'] = request.env["ir.ui.view"].render_template('portal_rating.rating_widget_stars_static', values={
+                        res_product['rating'] = request.env["ir.ui.view"]._render_template('portal_rating.rating_widget_stars_static', values={
                             'rating_avg': product.rating_avg,
                             'rating_count': product.rating_count,
                         })
diff --git a/addons/website_sale/controllers/variant.py b/addons/website_sale/controllers/variant.py
index 76069d26bc5..158d2cf97e2 100644
--- a/addons/website_sale/controllers/variant.py
+++ b/addons/website_sale/controllers/variant.py
@@ -14,7 +14,7 @@ class WebsiteSaleVariantController(VariantController):
         kw.pop('pricelist_id')
         res = self.get_combination_info(product_template_id, product_id, combination, add_qty, request.website.get_current_pricelist(), **kw)
 
-        carousel_view = request.env['ir.ui.view'].render_template('website_sale.shop_product_carousel',
+        carousel_view = request.env['ir.ui.view']._render_template('website_sale.shop_product_carousel',
             values={
                 'product': request.env['product.template'].browse(res['product_template_id']),
                 'product_variant': request.env['product.product'].browse(res['product_id']),