From d9287caf9408bb4ff85ad734cbca08e44321e205 Mon Sep 17 00:00:00 2001 From: Martin Trigaux Date: Fri, 14 Feb 2020 11:22:15 +0100 Subject: [IMP] *: convert to private methods render, render_template, load, activity_schedule_with_view, get_website_pages should all be private: It should not be possible to render an aribtrary template only with its name or id Still need to render some qweb views from js so the method render_template is kept public. This explains why the website editor still need read access on ir.ui.view as we want to allow any snippet to be rendered. --- addons/web/static/src/js/core/ajax.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'addons/web/static/src') diff --git a/addons/web/static/src/js/core/ajax.js b/addons/web/static/src/js/core/ajax.js index 21a0cbdc0fc..ae3194e2a45 100644 --- a/addons/web/static/src/js/core/ajax.js +++ b/addons/web/static/src/js/core/ajax.js @@ -456,7 +456,7 @@ var loadAsset = (function () { if (tplRoute === '/web/dataset/call_kw/') { Object.assign(params, { model: 'ir.ui.view', - method: 'render_template', + method: 'render_public_asset', }); } cache[xmlId] = rpc(tplRoute, params).then(function (xml) { -- cgit v1.2.3