From d9287caf9408bb4ff85ad734cbca08e44321e205 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Fri, 14 Feb 2020 11:22:15 +0100 Subject: [IMP] *: convert to private methods render, render_template, load, activity_schedule_with_view, get_website_pages should all be private: It should not be possible to render an aribtrary template only with its name or id Still need to render some qweb views from js so the method render_template is kept public. This explains why the website editor still need read access on ir.ui.view as we want to allow any snippet to be rendered. --- addons/web/models/models.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'addons/web/models/models.py') diff --git a/addons/web/models/models.py b/addons/web/models/models.py index 2e8d63b55be..348fecb8cb1 100644 --- a/addons/web/models/models.py +++ b/addons/web/models/models.py @@ -192,7 +192,7 @@ class Base(models.AbstractModel): @api.model def qweb_render_view(self, view_id, domain): assert view_id - return self.env['ir.qweb'].render( + return self.env['ir.qweb']._render( view_id, { **self.env['ir.ui.view']._prepare_qcontext(), **self._qweb_prepare_qcontext(view_id, domain), @@ -526,7 +526,7 @@ class ResCompany(models.Model): # One bundle for everyone, so this method # necessarily updates the style for every company at once company_ids = self.sudo().search([]) - company_styles = template_style.render({ + company_styles = template_style._render({ 'company_ids': company_ids, }) return base64.b64encode((company_styles)) -- cgit v1.2.3