diff options
| author | Benoit Socias <bso@odoo.com> | 2021-01-06 10:12:07 +0000 |
|---|---|---|
| committer | qsm-odoo <qsm@odoo.com> | 2021-01-06 14:17:21 +0000 |
| commit | 3fd40ba2030fef7dccf4046a932e3b3a172dc53f (patch) | |
| tree | 4c1f8ce147358ee165a1b5bf163838353288b0c1 /odoo/addons | |
| parent | 0de069b8ca9fb005ba5b076984f5677de25889ee (diff) | |
[FIX] web_editor, *: review `public_render_template`
*: website, base
The normal flow to render a template is now to use `render_public_asset`
which bypasses the read access rights if the user matches the groups
the view declares.
For public users, we still cannot use that as they do not have access
to calling model methods at all. The route `public_render_template` is
thus still needed, but it should use the `render_public_asset` util. In
master, it will only rely on it but as a stable fix, we still need to
use the whitelist as we cannot change the related views' group.
This commit also adds deprecated comments to the read_template method
which has been removed in master.
Related to task-2412544
closes odoo/odoo#64137
Signed-off-by: Quentin Smetz (qsm) <qsm@odoo.com>
Diffstat (limited to 'odoo/addons')
| -rw-r--r-- | odoo/addons/base/models/ir_ui_view.py | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/odoo/addons/base/models/ir_ui_view.py b/odoo/addons/base/models/ir_ui_view.py index 5d778d66f72..c77316d4557 100644 --- a/odoo/addons/base/models/ir_ui_view.py +++ b/odoo/addons/base/models/ir_ui_view.py @@ -1579,7 +1579,8 @@ actual arch. @api.model def read_template(self, xml_id): - """ Return a template content based on external id + """ This method is deprecated + Return a template content based on external id Read access on ir.ui.view required """ template_id = self.get_view_id(xml_id) |