From d9287caf9408bb4ff85ad734cbca08e44321e205 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Fri, 14 Feb 2020 11:22:15 +0100 Subject: [IMP] *: convert to private methods render, render_template, load, activity_schedule_with_view, get_website_pages should all be private: It should not be possible to render an aribtrary template only with its name or id Still need to render some qweb views from js so the method render_template is kept public. This explains why the website editor still need read access on ir.ui.view as we want to allow any snippet to be rendered. --- addons/web/controllers/main.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'addons/web/controllers') diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py index c68966af4bc..971181d14a1 100644 --- a/addons/web/controllers/main.py +++ b/addons/web/controllers/main.py @@ -1974,14 +1974,14 @@ class ReportController(http.Controller): del data['context']['lang'] context.update(data['context']) if converter == 'html': - html = report.with_context(context).render_qweb_html(docids, data=data)[0] + html = report.with_context(context)._render_qweb_html(docids, data=data)[0] return request.make_response(html) elif converter == 'pdf': - pdf = report.with_context(context).render_qweb_pdf(docids, data=data)[0] + pdf = report.with_context(context)._render_qweb_pdf(docids, data=data)[0] pdfhttpheaders = [('Content-Type', 'application/pdf'), ('Content-Length', len(pdf))] return request.make_response(pdf, headers=pdfhttpheaders) elif converter == 'text': - text = report.with_context(context).render_qweb_text(docids, data=data)[0] + text = report.with_context(context)._render_qweb_text(docids, data=data)[0] texthttpheaders = [('Content-Type', 'text/plain'), ('Content-Length', len(text))] return request.make_response(text, headers=texthttpheaders) else: -- cgit v1.2.3