From d9287caf9408bb4ff85ad734cbca08e44321e205 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Fri, 14 Feb 2020 11:22:15 +0100 Subject: [IMP] *: convert to private methods render, render_template, load, activity_schedule_with_view, get_website_pages should all be private: It should not be possible to render an aribtrary template only with its name or id Still need to render some qweb views from js so the method render_template is kept public. This explains why the website editor still need read access on ir.ui.view as we want to allow any snippet to be rendered. --- addons/http_routing/models/ir_http.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'addons/http_routing') diff --git a/addons/http_routing/models/ir_http.py b/addons/http_routing/models/ir_http.py index 7200c6153a8..9bd74a0a37d 100644 --- a/addons/http_routing/models/ir_http.py +++ b/addons/http_routing/models/ir_http.py @@ -601,7 +601,7 @@ class IrHttp(models.AbstractModel): @classmethod def _get_error_html(cls, env, code, values): - return code, env['ir.ui.view'].render_template('http_routing.%s' % code, values) + return code, env['ir.ui.view']._render_template('http_routing.%s' % code, values) @classmethod def _handle_exception(cls, exception): @@ -658,6 +658,6 @@ class IrHttp(models.AbstractModel): try: code, html = cls._get_error_html(env, code, values) except Exception: - code, html = 418, env['ir.ui.view'].render_template('http_routing.http_error', values) + code, html = 418, env['ir.ui.view']._render_template('http_routing.http_error', values) return werkzeug.wrappers.Response(html, status=code, content_type='text/html;charset=utf-8') -- cgit v1.2.3