From d9287caf9408bb4ff85ad734cbca08e44321e205 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Fri, 14 Feb 2020 11:22:15 +0100 Subject: [IMP] *: convert to private methods render, render_template, load, activity_schedule_with_view, get_website_pages should all be private: It should not be possible to render an aribtrary template only with its name or id Still need to render some qweb views from js so the method render_template is kept public. This explains why the website editor still need read access on ir.ui.view as we want to allow any snippet to be rendered. --- addons/payment/models/payment_acquirer.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'addons/payment') diff --git a/addons/payment/models/payment_acquirer.py b/addons/payment/models/payment_acquirer.py index a2333b414e2..c529688356f 100644 --- a/addons/payment/models/payment_acquirer.py +++ b/addons/payment/models/payment_acquirer.py @@ -478,7 +478,7 @@ class PaymentAcquirer(models.Model): }) _logger.info('payment.acquirer.render: <%s> values rendered for form payment:\n%s', self.provider, pprint.pformat(values)) - return self.view_template_id.render(values, engine='ir.qweb') + return self.view_template_id._render(values, engine='ir.qweb') def get_s2s_form_xml_id(self): if self.registration_view_template_id: -- cgit v1.2.3