The 'download' button should download *all* the attachments linked to
the move. Depending on the localization, an xml might be needed in
addition to the PDF (e.g. the CFDI and the signed PDF in Mexico).
To do that, we open a headless Send & Print wizard with only the
`download` checkbox set to True.
Secondly, do not show the 'Download' button in the portal view if no
official attachment is linked to the move (the print button still
appears).
task-3542881
Part-of: odoo/odoo#138206
Formerly, using sudo() on a record had the effect of replacing the
current user with the superuser. But sometimes, knowing who the "real
user" was was necessary, so we needed to store it somewhere. This is
basically why the key `binary_field_real_user` was introduced in the
context: to keep track of who the user was before switching to sudo
mode.
Since 1e6c3bec2c, however, switching to
sudo mode no longer changes the current user; meaning that the
`binary_field_real_user` is no longer necessary.
This commit removes the remaining occurrences of the now useless
`binary_field_real_user` from the code.
* = hr, portal, web_editor
closesodoo/odoo#92032
Enterprise: https://github.com/odoo/enterprise/pull/27649
Related: odoo/enterprise#27649
Signed-off-by: Louis Wicket (wil) <wil@odoo.com>
RATIONALE
Purpose of this change to rewrite the formatting done on messages displayed
on simple frontend i.e. portal chatter widget and project chatter.
We stop calling 'message_format' which computes a lot of unnecessary data
and sends too much information to frontend. We choose to instead manually
handcraft the returned data, already tailored for frontend widget.
SPECIFICATIONS
Remove call to '_message_format' in 'portal_message_format'. Instead have
a list of properties (fields or computation based on fields e.g. rating publisher
information) that can be overridden in sub-addons. Use those to generate
the data used by frontend chatter widget.
Remove extra formatting or data computation done in JS files. Do it directly
in 'portal_message_format' in order to have clean information sent.
This change targets mainly portal and portal_rating. Making those modules
Independent from backend message formatting allows to save queries and
also to avoid sending useless information to the frontend.
Task-3322905
Part-of: odoo/odoo#121104
Allow partner to unfollow a document from a follow up email of that document
through an unsubscribe URL in the email even if not connected.
It works for internal user for follow up on any document and for any partner on
follow up of document tagged as authorizing being unfollowed by any partner (
slide.channel and slide.slide).
Technical note:
The unfollow block is rendered in mail_thread and updated for each recipient in
mail_mail. We don't render it in mail_mail because we don't have the language
of the message at that point.
Depending on the partner and the related document, the unfollow block is:
- either removed if the user cannot unfollow the document (for example if it
doesn't follow it)
- or updated with partner and document information + a security token
Task-3061864
Part-of: odoo/odoo#107978
Before this commit, the "Your contact" details in the portal
layout were not shown if the user_id (salesperson) was not set
on the portal user's partner.
In order for them to have contact info in that case, we now use
as a fallback contact the one responsible of their company, i.e.
the first company in the parent hierarchy (corresponding to the
commercial_partner_id field).
We still do not use the user if it they are a public user.
Task-3213421
closesodoo/odoo#114599
Signed-off-by: Warnon Aurélien (awa) <awa@odoo.com>
Purpose of this commit is to try to make code a bit easier to follow using
dicts, sets and tuples, as well as updating some variable names.
Also rename the method to be clearer. Tools methods may omit the namespacing
to avoid too much confusion in naming.
Task-2710804 (Mail: Clean MailThread API)
Part-of: odoo/odoo#106658
PURPOSE
Purpose of this task is to cleanup attachment management done in generic mail
models overrides and move it in account as model overrides.
SPECIFICATIONS
Accounting holds code to handle attachments linked to their custom composer
(``account.invoice.send``) that uses through inheritance the mail composer
(``mail.compose.message``) that has a specific processing of attachments
to link pending composer attachments to the right records.
Indeed attachments linked to the composer are pending attachments, and are
linked to the record when posting the message. This allows to know which
attachments have been added by the user, have specific rules for access
rights, ...
However this code has been wrongly added directly at mixing level at
odoo/odoo@bdcc012004. Instead ``_message_post_process_attachments`` method
should always be called based on a record, allowing to locate the override
at model level.
Task-2792146 (Mail: Move model-dependent code from composer / template)
Task-2710804 (Mail: Clean MailThread API)
Part-of: odoo/odoo#106658
When mail_action_view() calls this function, the model may not be a valid
one or even be missing. So we check if the model exists before checking its
type.
We also correctly add kwargs parameters propagation.
Add tests.
Task-3025143
X-original-commit: b5d9f42ddc2dfde21714544add72023004069815
Part-of: odoo/odoo#103378
Co-authored-by: Krzysztof Magusiak <kmagusiak>
Currently using the ``chatter_post`` route to post a message implicitly checks
for access rights on related record. It is done manually in ``message_post``
that is called by the route. It is done because record name is accessed as
sudo and an explicit access has been added because of fear of information
leak.
However this is a bit out of scope for ``message_post`` to perform that check
at that point. As the underlying record is accessed numerous times, adding
an explicit check just adds queries.
In portal, users may have a token and/or a hash and a partner_id, in which
case they enter sudo mode if valid, and an error is raised otherwise. However
when not using a token and/or a hash and a PID access check is now done
directly in the controller helper. Moreover this allows to have the access
error directly instead of being possibly hidden by another error, which was
the case before this fix (was actually raising about missing email_from).
In this commit we add an explicit check on record access before entering
the post computation. That way access errors are directly raised.
A fix in accounting is necessary to ensure the right error is raised. Indeed
otherwise it currently raises due to non existing email_from, and should
raise due to ACL instead. Tests are now more inlined with classic flows.
Task-2710804 (Mail: Clean MailThread API)
Part-of: odoo/odoo#99654
Some countries, such as mexico, require a seller to be able to
generate an invoices from a ticket from a sale done in a shop,
even after a few days.
This change aims to allow this, by allowing to create an invoice at
a later date after the POS has been closed.
This is done by partially reversing the POS closing entry, and then
generating an invoice the same way it would be done at the POS closing.
The customer can scan a QR code if enabled in order to request the
invoice by himself, requiring him to fill a for to give the customer
information required for the invoicing.
Allows to fill additional fields dependent on the localization that are
required to be set on the partner or the invoice.
Task id #2946604closesodoo/odoo#97675
Related: odoo/enterprise#30599
Signed-off-by: Laurent Smet <las@odoo.com>
* portal, web_unsplash, website_*
This commit renames the `website.group_website_publisher` into
`website.group_website_restricted_editor`.
While the change in itself might look unuseful, it will help the dev and
tech community figuring which group is related to which feature.
Even internally when we discuss specs, we always have to remind which
group is the restricted editor: the publisher one or the designer one?
While it is probably, after all those years, now anchored in some dev
mind, there is no easy way to directly figure which of those 2 groups is
the restricted editor one.
Note that I myself always got confused about it.
Now, the "Restricted Editor" right will be reflected in its technical
name `group_website_restricted_editor`.
Same as for the "Editor & Designer" which technical name is
`group_website_designer`.
As we would like to have a fully working and ready system in v17 for the
community to be able to build themes easily, removing that dubious part
is a nice to have.
Part-of: odoo/odoo#98200
The render API was confusing as mixing the access to the report and
the rendering env.
The ambiguity was present for code such as
`report.sudo()._render(record_ids)` where it was not clear if the
`sudo()` is needed to access to `report` or to `record_ids`. For low
priviledge users (such as portal or public), it was common to use
`report.with_user(SUPERUSER_ID)._render(record_ids)`.
This PR changes the render methods signature to be `api.model`. The
`report_ref` can be:
- ir.actions.report external id
- ir.actions.report id
- ir.actions.report recod
- `report_name` value
This will allow to call the report methods with any user and no longer
need to use `with_user(1)` to render reports as public user.
Task-id 2670865
closesodoo/odoo#91341
Related: odoo/upgrade#3650
Related: odoo/enterprise#27323
Signed-off-by: Martin Trigaux (mat) <mat@odoo.com>
In some cases, empty messages can be displayed in the portal chatter.
For instance, if a customer sends a message with no body and just
an attachment, and the attachment then gets deleted, it will still
be displayed as an empty message in the portal chatter.
To solve this, this commit filters out empty messages from the portal chatter.
Task-2833919
closesodoo/odoo#94828
X-original-commit: 10d2a3e01a0fb62860e502cc67e5311b9420a684
Signed-off-by: Warnon Aurélien (awa) <awa@odoo.com>
Purpose
=======
Allow portal users to deactivate their accounts from the portal view.
After the deactivation, they are redirected to the login page, so
they can verify that they can not longer login with their credentials.
We first archived the record and remove sensitive information (password,
login, so he can not log in again with the same credentials).
After the deactivation, we blacklist the email and the phone of the
user, so we are sure that we never send him again email / SMS.
Then, we create a <res.users.deletion> to delete the user and the
partner in a CRON because this operation can be heavy (write_uid,
create_uid field on all models).
Task-2629544
Part-of: odoo/odoo#78298
Default value for attachment_ids / tokens is None. However a check method consider those
as lists and check their length. When calling chatter_post without giving at least a void
list there is therefore a crash that can be easily avoided.
closesodoo/odoo#94695
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Steps to reproduce
------------------
1. Create two partners A and B.
2. Create a shareable record, e.g. a sales order, and set A as the customer.
3. Share the record with B.
4. Use the share link sent to B and comment on the record.
5. Your comments will be sent with A as the author.
Expected behavior
-----------------
Share links sent to a customer should make you comment as that customer.
Task-2883044
X-original-commit: df162acc589b74b0e3c1e9687ce6a1980233f5f1
Part-of: odoo/odoo#94695
*: auth_signup, portal, web, website_knowledge
When navigating in the iframe, only same origin redirections should be
open in the iframe contentWindow. External redirections should be done
in the top window.
Some internal pages had to be served with X-Frame-Options header set to
SAMEORIGIN, and Content-Security-Policy to "frame-ancestors 'self'" (see
[1]).
All the links that are redirecting to another host, and the client
actions, are opened in the top window.
Exemples that will be opened in the iframe's top window:
- Clicking on a link google.be that should not open in a new tab
- Clicking on the language selector and adding a new one, or
clicking on "logout".
[1]: https://github.com/odoo/odoo/pull/78298#discussion_r898853383
See merge commit for more information.
task-2687506
Co-authored-by: Arthur Detroux <ard@odoo.com>
Co-authored-by: qsm-odoo <qsm@odoo.com>
No method was readily available to know if a user is `internal` (has
group `base.group_user`), which was inconsistent with other base groups.
_is_internal is now used in the codebase where it is clear that
`.has_group('base.group_user')` is called on a single record.
Part-of: odoo/odoo#85703
When portal is not installed and `auth_signup.invitation_scope` is "b2c",
visitors can create an account, leading to a blank page. Still, accounts can be
required for several use cases in apps that do not require portal (such as
survey).
We here add a landing page for users that created an account but have no
requested redirections and cannot be redirected to a customer portal either.
auth_signup_uninvited is also updated in model to be consistent with config
data.
Tests are added to check this behavior.
Task-2762102
Part-of: odoo/odoo#85703
Purpose
=======
Change all masculine nouns in Odoo's code to neutral nouns (when
possible), making sure that demo data is correctly handled. This is
particularly important since our code is open source, and nowadays lots
of machine learning models are trained on open source repositories.
With this small change we contribute to training more "fair" models, and
teaching models that "employee" or "user" != "he".
This also affects some text visible by the user, hence making it more
inclusive for Odoo users.
Task-2853046
closesodoo/odoo#91292
Related: odoo/enterprise#27302
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
The odoo.addons.web.controllers.main python module have been splitted
over multiple files on the basis 1 controller = 1 file. In this work we
adapt all modules to use the new imports.
A non-exhaustive list of where stuff have been moved:
* main.Home --> home.Home
* main.Session --> session.Session
* main.WebClient --> webclient.WebClient
* main.clean_action --> action.clean_action
* main.ensure_db --> home.ensure_db
The complete list is accessible in odoo.addons.web.controllers.main.
closesodoo/odoo#87571
Related: odoo/enterprise#25746
Signed-off-by: Raphael Collet <rco@odoo.com>
Add the possibility for portal users to manage API keys
in the frontend portal interface.
- Allow for portal users to manage their API keys if the system parameter
`portal.allow_api_keys` is set.
A settting in `res.config.settings` is added in order
to enable or disable the feature (to add/remove the system parameter)
through a compute field,
to avoid adding a new database column in standard
(as this revision targets stable 15.0).
The setting appear only in debug mode.
- Display the API keys in the portal in debug mode only
(as in the back-end for regular users, in their profile)
- The flow in the frontend is a mimic of the flow from the backend,
the wording and the look and feel is from the back-end.
closesodoo/odoo#86915
Signed-off-by: Denis Ledoux (dle) <dle@odoo.com>
This commit is the 14th commit of a comprehensive refactor of our HTTP
framework. See odoo/odoo#78857 for complete historic, discussions and
rationnals.
* `request.uid = x` => `request.update_env(user=x)`.
* `request.context = x` => `request.update_env(context=x)`.
* `request.context = dict(request.context, x=y)`
=> `request.update_context(x=y)`.
* `request.cr = None` => `request.cr.close()`.
* `http.mono_db()` => `request.db`.
* `http.dispatch_rpc()` => `service.dispatch_rpc()`.
* `@service.model.check` => `service.model.retrying()`.
* `request.endpoint`
=> `env['ir.http']._match(request.httprequest.path)[0].endpoint`.
* `request.routing_iteration `=> `removed`.
* `request.jsonrequest` => `request.dispatcher.jsonrequest`.
Note that `request.params` is now set much later in the process. If you
are in a situation where you values from the query string or the
http body you can use `request.get_http_params()`.
Note that using the new `request.future_response`, it is possible to
add headers and cookies on the response object before the response
object is initialized. Please note that headers/cookies saved on
the future response will NOT be injected in case of error.
PR: odoo#78857
Task: 2571224
In order to reduce friction and ease the rating process for attendees,
we do not force the constraint stating that the message must contain a
message or an attachment onto the users. Instead, we allow ratings and
replace the empty message by a blank space to avoid triggering the error
message. If no stars are selected, an error message is now displayed to
the user, asking to select a rating before submission, preventing them
to post their review until then.
Since we do not really support 0 stars ratings, and do not want the user
to see that error message in case of the course, we set the default rating
to 4.0 instead of 0.0.
-> Therefore, we also remove the grey star contrast coloring on first review
since we do not want the user to have the impression a choice has already
be made beforehand. In that case, everything will be yellow.
Void content detection is done by extracting it in both python (portal
chatter post controller) and frontend (submission check) and relaxing it
in slides modules.
Task-2728564
Part-of: odoo/odoo#82792
Purpose of this commit is to make ``get_access_action`` private as it is not
necessary to expose it directly. Website management is also made explicit
using a ``force_website`` parameter instead of relying on context key of the
same name. This allows to better understand the method code flow.
Contains also some code fix / improvements :
* Website forum: update code to better skip the frontend redirection if the
forum is not active and frontend is not forced;
* Website slides: respect force website parameter in redirection;
Task-2710804 (Mail: Clean Mail.Thread API)
Part-of: odoo/odoo#82167
Within portal, subscriptions/sales orders presented in list view have their URL
containing the access_token as a GET param. However, when clicking on a
subscription and using the pager to navigate between records, the access_token
is not present in the URL. In order to keep consistency between the links and
views, this PR adds the access_token as a GET param in the pager as well.
task-2512070
closesodoo/odoo#76673
Related: odoo/upgrade#2752
Related: odoo/enterprise#20357
Signed-off-by: Arnaud Joset <arj@odoo.com>
Adds multi record support to `_show_report`.
Limited to records within the same company to stay as close as possible
to the default behaviour.
Closes: odoo/odoo#75269
See: odoo/enterprise#20334
Task ID: 2611006
Purpose
=======
Clean up messages related to email verification.
Specification
=============
Rephrase messages, add confirmation of email sent and let user change
email.
Do not show "Validation Email sent" if the current user changed their
email address.
PR: https://github.com/odoo/odoo/pull/77617
Task-2647065
closesodoo/odoo#77617
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
PURPOSE
Generic UX improvements for the portal
SPECIFICATIONS
For projects list view,
- clicking on the project should open the list view of tasks with groupby stage
- the number of tasks should not be clickable
For tasks list view,
- display the fa-star of the priority field on the left of the name of the task
- add the following fields on the right of the name:
user_id, time spent, kanban_state
- for the kanban_state,
only display the colored dot and indicate the name of the state on hover
- for the time spent:
indicate the nb of hours recorded / nb of planned hours(or days(as per unit))
(if the nb of planned hours = 0, only display the nb of hours recorded)
For tasks search view,
- add a group by priority and status and reorder accordingly
- add a quick search on status and priority and reorder accordingly
- add a sort by priority, assigned to and status and reorder accordingly
For task form view,
- display the fa-star icon of the priority field on the left of the name of task
- add the kanban state in the top right corner
the kanban_state field should be editable by portal users
increase nb of items displayed in the list view to 80 items per page(generic)
Task-2613330
closesodoo/odoo#74996
Signed-off-by: LTU-Odoo <IT-Ideas@users.noreply.github.com>
Co-authored-by: Xavier BOL (xbo) <xbo@odoo.com>
As mail grows and will continue to grow, ordering views and having right
files is important to understand module organization and content.
Split main.py controller file into two files, one for mail related controllers
(redirections) and one for discuss.
Rename files according to guidelines for wizards and views.
No functional change comes with this commit. This is only code move.
Task-2631873
PR odoo/odoo#75571
This branch adds request.redirect on all requests.
In case of a front end request, we do an url_for to the location.
We removed redirect_with_hash that was only for retro compatibility
local_redirect has been renamed to redirect_query, and param keep_hash has been
removed and moved.
Default code for redirect is 303 now instead of 302.
Now redirect and redirect_query make local redirect by default, you need to
pass local=False to make external redirect.
All werkeug.utils.redirect has been replaced by request.redirect.
Http.redirect now use an http.Response type, and it become easy to add an
override like 'set_cookies' e.g.
Dispatch of a website.page return an http.response too, so we first need to
check if it is a cached version before to check if it is an Odoo Response.
Migrate your code:
http.redirect -> request.redirect(location, code, local)
http.local_redirect -> request.redirect_query(location, query, code, local)
http.redirect_with_hash -> request.redirect
Courtesy of odony for help and review ;)
closesodoo/odoo#72599
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
The company is needed in the context to get the paper format for
instance because of `get_paperformat`
X-original-commit: a1526eb4e5b1eb7cada603d7fcee7bb77c64bbac
Issue
- Install "Sale" app
- Acivate "Discounts" feature in settings
- Create a quotation to a portal user (ex: Joel Willis)
- Add a product with a discount then send
- Logout then login as 'Joel Willis'
- Go to 'My account' then 'Quotations'
- Select the quotation just created and print it
Discount not display in pdf file.
Cause
The current env.user when rendering pdf is the portal user.
To display discount, current env.user must have group
'product.group_discount_per_so_line' who is not the case
even when using sudo() on report template.
Solution
Since Odoo 13.0, the sudo() function does not return the
superuser by default but instead the current user
with a bypass on access rights.
Therefore, must add `.with_user(SUPERUSER_ID)` on report.
opw-2501337
closesodoo/odoo#69272
X-original-commit: 5dde19c92ecee8ac0238bb5c8e71263840534c28
Signed-off-by: bon-odoo <nboulif@users.noreply.github.com>
1) in this commit, improved portal chatter for messaging. when the user sends a
message, the new message is updated in history without reloading page.
instead of submitting a form which reloads page to send message we added rpc call
to send message.
2) rating on courses is implemented by extending portal chatter, applied changes in
website_slides to do reviews without reloading page
3) refactoring: cleaned or removed code
eg. removed form and some input fields as data is not submitted as form anymore,
introduced some methods to avoid duplication of code
task-2054662
Closes https://github.com/odoo/odoo/pull/47746closesodoo/odoo#47746
Signed-off-by: Samuel Degueldre <sdegueldre@users.noreply.github.com>
Co-authored-by: ktr-odoo <ktr@odoo.com>
Co-authored-by: Siddarth Gajjar <sga@odoo.com>
This commit adapts the business code in which
class/module/function/method redefinition took place so that it no
longer happens and the pylint test passes.
PURPOSE
Clean code and be and more performance oriented.
SPECIFICATIONS
Various portal pages hold references to archive_groups. It was a summary
of customer documents for portal, containing a count of all documents split
by model.
Currently its computation is not used. Indeed archive_groups is displayed
only in 'my_details' page that does not hold any document-based reference
or code call. Other calls to archive_groups are dead code as the result is
not used. Since 13.0 it is even not computed on standard pages to speedup
their load (as it was not used).
It is not used anymore and its computation and references can be removed
safely, especially with v14 in mind for which we want to remove dead code
to maintain.
Followup of odoo/odoo#55228
LINKS
Task ID-2329081
PR odoo/odoo#55800
PR #12368closesodoo/odoo#56859
X-original-commit: e75086000ee4317b2ad2994db5d906fbcbd5081f
Related: odoo/enterprise#12830
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
Signed-off-by: Victor Feyens (vfe) <vfe@odoo.com>
Before this commit, the time to compute all counters was making the rendering
of the portal page slow.
Now the count is done in rpc after the loading of the page.
Now you can decide which part you want to show on the portal, and only compute
for these one.
It is not because you have purchase installed for your internal process, that
it means that your supplier use your portal and it avoid the computation for
all end users.
We parallelize the counters in arbitrary 3 rpcs.
closesodoo/odoo#55999
Related: odoo/enterprise#12456
Signed-off-by: Jérémy Kersten (jke) <jke@openerp.com>
* allows portal users to update their password
* and manage their API keys
* any anything technical / security related we may need to add in the
future
Also bridge module for the password meter (auth password policy).
* migrate website to overriding web_login less (still needed to flag it
as website-enabled) and use _login_redirect for its login redirection
override needs
* modify portal and website to not replace / shortcut the redirection
workflow, so it's possible to override those properly if / as
necessary
Before this commit, some errors were shown to the end user when
he tried to login to the mobile app with a portal user.
The problem is the user was stuck to a blank page and wasn't
able to logout even after reloading the app.
Note that even if portal users aren't supposed to access to the
backend, it's quite annoying to not be able to go back.
After this commit, portal users are automatically redirected to
the portal page ("/my") if they try go to "/web". This is the same
behavior as when portal users login via "/web/login".
By doing this we avoid having custom code in the native apps
because we already avoid any login to the app if we are out of "/web".
Note: this commit doesn't cover all cases as portal users are defined in
the "base" module and the portal page is set in the "portal" module.
So this this fix will not work if "portal" is not installed and if you
manually created a portal user (only possible in debug mode).
This is unlikely and we therefore consider that this fix covers the
majority of cases while being the safest.
Task ID: 2266024
opw-2281168
closesodoo/odoo#55439
X-original-commit: 29cbba73a71990e76f497ee892ce16fc7fc53d9f
Signed-off-by: Adrien Dieudonné (adr) <adr@odoo.com>
The record counts are only useful for the badges displayed in /my &
/my/home.
By avoiding those counts on subpages, we gain a lot of useless queries,
improving the loading speed of those sub-pages.
X-original-commit: 79c8384f1bcbcdede030e187008319a70c664571
Using a few regex like
\((_\(.*%s.*)(\) % )([\w\[\]][\w .\[\]\(\)'"]*)\)
($1, $3))
Old syntax is still compatible but starts the migration to the new
syntax that catches error.
Bugs
====
On e-commerce, the portal user is not able to upload
attachment with his comment, under a product.
On website blog, the portal user is not able to upload attachment with
his comment, in the discussion of the blog.
And, in `website_crm_partner_assign`, portal user is not able to upload
attachment with his comment, under the lead/opp.
Issue
=====
In the create method of the mail message, we check is the user can
read the attachment. If he can't, we raise an error.
But, the method that make the verification doesn't care about the access
token. So, when a portal user want to upload an attachment on a "public"
record (without a token on the record to sudoed it) the error is raised.
The portal user give an token for the attachment, so he should be able
to attach it to the message. This verification is done with
`_portal_post_check_attachments` so we can sudo write the attachment
after the creation of the mail message to bypass the verification.
Task-2214795
closesodoo/odoo#51772
X-original-commit: d59f8f62dbc7771fee51c3593f89f9b6832bb7ec
Signed-off-by: Thibault Delavallee (tde) <tde@openerp.com>
render, render_template, load, activity_schedule_with_view,
get_website_pages should all be private:
It should not be possible to render an aribtrary template only with
its name or id
Still need to render some qweb views from js so the method
render_template is kept public.
This explains why the website editor still need read access on
ir.ui.view as we want to allow any snippet to be rendered.
Julien Van Roy