[IMP] *: convert to private methods

render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id

Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.

1 files changed, 25 insertions, 25 deletions

diff --git a/odoo/addons/base/tests/test_qweb.py b/odoo/addons/base/tests/test_qweb.py
index 780dc6a0cc5..00cf26d4031 100644
--- a/odoo/addons/base/tests/test_qweb.py
+++ b/odoo/addons/base/tests/test_qweb.py
@@ -25,7 +25,7 @@ class TestQWebTField(TransactionCase):
         field = etree.Element('span', {'t-field': u'company.name'})
         company = self.env['res.company'].create({'name': "My Test Company"})
 
-        result = self.engine.render(field, {'company': company})
+        result = self.engine._render(field, {'company': company})
         self.assertEqual(
             etree.fromstring(result),
             etree.fromstring(u'<span data-oe-model="res.company" data-oe-id="%d" '
@@ -41,7 +41,7 @@ class TestQWebTField(TransactionCase):
         s = u"Testing «ταБЬℓσ»: 1<2 & 4+1>3, now 20% off!"
         company = self.env['res.company'].create({'name': s})
 
-        result = self.engine.render(field, {'company': company})
+        result = self.engine._render(field, {'company': company})
         self.assertEqual(
             etree.fromstring(result),
             etree.fromstring(u'<span data-oe-model="res.company" data-oe-id="%d" '
@@ -56,13 +56,13 @@ class TestQWebTField(TransactionCase):
         field = etree.Element('td', {'t-field': u'company.name'})
 
         with self.assertRaisesRegex(QWebException, r'^RTE widgets do not work correctly'):
-            self.engine.render(field, {'company': None})
+            self.engine._render(field, {'company': None})
 
     def test_reject_t_tag(self):
         field = etree.Element('t', {'t-field': u'company.name'})
 
         with self.assertRaisesRegex(QWebException, r'^t-field can not be used on a t element'):
-            self.engine.render(field, {'company': None})
+            self.engine._render(field, {'company': None})
 
     def test_render_t_options(self):
         view1 = self.env['ir.ui.view'].create({
@@ -72,7 +72,7 @@ class TestQWebTField(TransactionCase):
                 <t t-name="base.dummy"><root><span t-esc="5" t-options="{'widget': 'char'}" t-options-widget="'float'" t-options-precision="4"/></root></t>
             """
         })
-        text = etree.fromstring(view1.render()).find('span').text
+        text = etree.fromstring(view1._render()).find('span').text
         self.assertEqual(text, u'5.0000')
 
     def test_xss_breakout(self):
@@ -88,7 +88,7 @@ class TestQWebTField(TransactionCase):
                 </t>
             """
         })
-        rendered = view.render({'malicious': '1</script><script>alert("pwned")</script><script>'}).decode()
+        rendered = view._render({'malicious': '1</script><script>alert("pwned")</script><script>'}).decode()
         self.assertIn('alert', rendered, "%r doesn't seem to be rendered" % rendered)
         doc = etree.fromstring(rendered)
         self.assertEqual(len(doc.xpath('//script')), 1)
@@ -119,7 +119,7 @@ class TestQWebNS(TransactionCase):
             """ % expected_result
         })
 
-        self.assertEqual(etree.fromstring(view1.render()), etree.fromstring(expected_result))
+        self.assertEqual(etree.fromstring(view1._render()), etree.fromstring(expected_result))
 
     def test_render_static_xml_with_namespace_2(self):
         """ Test the rendering on a namespaced view with no static content. The resulting string should be untouched.
@@ -157,7 +157,7 @@ class TestQWebNS(TransactionCase):
             """ % expected_result
         })
 
-        self.assertEqual(etree.fromstring(view1.render()), etree.fromstring(expected_result))
+        self.assertEqual(etree.fromstring(view1._render()), etree.fromstring(expected_result))
 
     def test_render_static_xml_with_useless_distributed_namespace(self):
         """ Test that redundant namespaces are stripped upon rendering.
@@ -190,7 +190,7 @@ class TestQWebNS(TransactionCase):
             </root>
         """)
 
-        self.assertEqual(etree.fromstring(view1.render()), expected_result)
+        self.assertEqual(etree.fromstring(view1._render()), expected_result)
 
     def test_render_static_xml_with_namespace_3(self):
         expected_result = u"""
@@ -205,7 +205,7 @@ class TestQWebNS(TransactionCase):
             """ % expected_result
         })
 
-        self.assertEqual(etree.fromstring(view1.render()), etree.fromstring(expected_result))
+        self.assertEqual(etree.fromstring(view1._render()), etree.fromstring(expected_result))
 
     def test_render_dynamic_xml_with_namespace_t_esc(self):
         """ Test that rendering a template containing a node having both an ns declaration and a t-esc attribute correctly
@@ -223,7 +223,7 @@ class TestQWebNS(TransactionCase):
 
         expected_result = etree.fromstring(u"""<Invoice xmlns:cac="urn:oasis:names:specification:ubl:schema:xsd:CommonAggregateComponents-2">test</Invoice>""")
 
-        self.assertEqual(etree.fromstring(view1.render()), expected_result)
+        self.assertEqual(etree.fromstring(view1._render()), expected_result)
 
     def test_render_dynamic_xml_with_namespace_t_esc_with_useless_distributed_namespace(self):
         """ Test that rendering a template containing a node having both an ns declaration and a t-esc attribute correctly
@@ -247,7 +247,7 @@ class TestQWebNS(TransactionCase):
             </Invoice>
         """)
 
-        self.assertEqual(etree.fromstring(view1.render()), expected_result)
+        self.assertEqual(etree.fromstring(view1._render()), expected_result)
 
     def test_render_dynamic_xml_with_namespace_t_attf(self):
         """ Test that rendering a template containing a node having both an ns declaration and a t-attf attribute correctly
@@ -287,7 +287,7 @@ class TestQWebNS(TransactionCase):
             </root>
         """)
 
-        self.assertEqual(etree.fromstring(view1.render()), expected_result)
+        self.assertEqual(etree.fromstring(view1._render()), expected_result)
 
     def test_render_dynamic_xml_with_namespace_t_attf_with_useless_distributed_namespace(self):
         """ Test that rendering a template containing a node having both an ns declaration and a t-attf attribute correctly
@@ -329,7 +329,7 @@ class TestQWebNS(TransactionCase):
 
         """)
 
-        self.assertEqual(etree.fromstring(view1.render()), expected_result)
+        self.assertEqual(etree.fromstring(view1._render()), expected_result)
 
     def test_render_dynamic_xml_with_namespace_2(self):
         view1 = self.env['ir.ui.view'].create({
@@ -362,7 +362,7 @@ class TestQWebNS(TransactionCase):
             </Invoice>
         """)
 
-        self.assertEqual(etree.fromstring(view1.render({'version_id': 1.0})), expected_result)
+        self.assertEqual(etree.fromstring(view1._render({'version_id': 1.0})), expected_result)
 
     def test_render_static_xml_with_namespaced_attributes(self):
         view1 = self.env['ir.ui.view'].create({
@@ -377,7 +377,7 @@ class TestQWebNS(TransactionCase):
 
         expected_result = etree.fromstring(u"""<cfdi:Comprobante xmlns:cfdi="http://www.sat.gob.mx/cfd/3" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.sat.gob.mx/cfd/3 http://www.sat.gob.mx/sitio_internet/cfd/3/cfdv32.xsd">abc</cfdi:Comprobante>""")
 
-        self.assertEqual(etree.fromstring(view1.render()), expected_result)
+        self.assertEqual(etree.fromstring(view1._render()), expected_result)
 
     def test_render_dynamic_xml_with_namespaced_attributes(self):
         view1 = self.env['ir.ui.view'].create({
@@ -392,7 +392,7 @@ class TestQWebNS(TransactionCase):
 
         expected_result = etree.fromstring("""<cfdi:Comprobante xmlns:cfdi="http://www.sat.gob.mx/cfd/3" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.sat.gob.mx/cfd/3 http://www.sat.gob.mx/sitio_internet/cfd/3/cfdv32.xsd">abc</cfdi:Comprobante>""")
 
-        self.assertEqual(etree.fromstring(view1.render()), expected_result)
+        self.assertEqual(etree.fromstring(view1._render()), expected_result)
 
     def test_render_static_xml_with_t_call(self):
         view1 = self.env['ir.ui.view'].create({
@@ -426,7 +426,7 @@ class TestQWebNS(TransactionCase):
             """
         })
 
-        result = view2.render()
+        result = view2._render()
         result_etree = etree.fromstring(result)
 
         # check that the root tag has all its xmlns
@@ -490,7 +490,7 @@ class TestQWebNS(TransactionCase):
         """)
 
         self.assertEqual(
-            etree.fromstring(view1.with_context(check_view_ids=[view1.id, view2.id]).render()),
+            etree.fromstring(view1.with_context(check_view_ids=[view1.id, view2.id])._render()),
             expected_result
         )
 
@@ -516,7 +516,7 @@ class TestQWebNS(TransactionCase):
             error_msg = e.args[0]
 
         with self.assertRaises(QWebException, msg=error_msg):
-            view1.render()
+            view1._render()
 
     def test_render_t_call_propagates_t_lang(self):
         current_lang = 'en_US'
@@ -554,7 +554,7 @@ class TestQWebNS(TransactionCase):
             """ % other_lang
         })
 
-        rendered = view2.with_context(lang=current_lang).render().strip()
+        rendered = view2.with_context(lang=current_lang)._render().strip()
         self.assertEqual(rendered, b'9/000/000*00')
 
 
@@ -622,7 +622,7 @@ class TestQWeb(TransactionCase):
 
             result = doc.find('result[@id="{}"]'.format(template)).text
             self.assertEqual(
-                qweb.render(template, values=params, load=loader).strip(),
+                qweb._render(template, values=params, load=loader).strip(),
                 (result or u'').strip().encode('utf-8'),
                 template
             )
@@ -646,7 +646,7 @@ class TestPageSplit(TransactionCase):
             </t>
             '''
         })
-        rendered = html.fromstring(self.env['ir.qweb'].render(t.id))
+        rendered = html.fromstring(self.env['ir.qweb']._render(t.id))
         ref = E.div(
             E.table(E.tr()),
             E.div({'style': 'page-break-after: always'}),
@@ -669,7 +669,7 @@ class TestPageSplit(TransactionCase):
             </t>
             '''
         })
-        rendered = html.fromstring(self.env['ir.qweb'].render(t.id))
+        rendered = html.fromstring(self.env['ir.qweb']._render(t.id))
         self.assertTreesEqual(
             rendered,
             E.div(
@@ -694,7 +694,7 @@ class TestPageSplit(TransactionCase):
             </t>
             '''
         })
-        rendered = html.fromstring(self.env['ir.qweb'].render(t.id))
+        rendered = html.fromstring(self.env['ir.qweb']._render(t.id))
         self.assertTreesEqual(
             rendered,
             E.div(E.table(E.tr(), E.tr(), E.tr()))