diff --git a/addons/auth_oauth/controllers/main.py b/addons/auth_oauth/controllers/main.py
index a5a888f51a2..0e8270d7eed 100644
--- a/addons/auth_oauth/controllers/main.py
+++ b/addons/auth_oauth/controllers/main.py
@@ -131,6 +131,8 @@ class OAuthController(http.Controller):
     def signin(self, **kw):
         state = json.loads(kw['state'])
         dbname = state['d']
+        if not http.db_filter([dbname]):
+            return BadRequest()
         provider = state['p']
         context = state.get('c', {})
         registry = registry_get(dbname)
@@ -180,6 +182,8 @@ class OAuthController(http.Controller):
             dbname = db_monodb()
         if not dbname:
             return BadRequest()
+        if not http.db_filter([dbname]):
+            return BadRequest()
 
         registry = registry_get(dbname)
         with registry.cursor() as cr:
diff --git a/addons/sale_stock/tests/test_sale_stock.py b/addons/sale_stock/tests/test_sale_stock.py
index 1544c78288c..ab39a0d2129 100644
--- a/addons/sale_stock/tests/test_sale_stock.py
+++ b/addons/sale_stock/tests/test_sale_stock.py
@@ -52,7 +52,7 @@ class TestSaleStock(TestSale):
         pick_2 = self.so.picking_ids[0]
         pick_2.force_assign()
         pick_2.pack_operation_product_ids.write({'qty_done': 1})
-        self.assertTrue(pick_2.do_new_transfer(), 'Sale Stock: second picking should be final without need for a backorder')
+        self.assertIsNone(pick_2.do_new_transfer(), 'Sale Stock: second picking should be final without need for a backorder')
         self.assertEqual(self.so.invoice_status, 'to invoice', 'Sale Stock: so invoice_status should be "to invoice" after complete delivery')
         del_qties = [sol.qty_delivered for sol in self.so.order_line]
         del_qties_truth = [2.0 if sol.product_id.type in ['product', 'consu'] else 0.0 for sol in self.so.order_line]
@@ -100,7 +100,7 @@ class TestSaleStock(TestSale):
         pick = self.so.picking_ids
         pick.force_assign()
         pick.pack_operation_product_ids.write({'qty_done': 2})
-        self.assertTrue(pick.do_new_transfer(), 'Sale Stock: complete delivery should not need a backorder')
+        self.assertIsNone(pick.do_new_transfer(), 'Sale Stock: complete delivery should not need a backorder')
         del_qties = [sol.qty_delivered for sol in self.so.order_line]
         del_qties_truth = [2.0 if sol.product_id.type in ['product', 'consu'] else 0.0 for sol in self.so.order_line]
         self.assertEqual(del_qties, del_qties_truth, 'Sale Stock: delivered quantities are wrong after partial delivery')
diff --git a/addons/stock/models/stock_picking.py b/addons/stock/models/stock_picking.py
index f5039f3d618..9a00c2660d4 100644
--- a/addons/stock/models/stock_picking.py
+++ b/addons/stock/models/stock_picking.py
@@ -847,7 +847,7 @@ class Picking(models.Model):
             if pack_operations_delete:
                 pack_operations_delete.unlink()
         self.do_transfer()
-        return True
+        return
 
     def check_backorder(self):
         need_rereserve, all_op_processed = self.picking_recompute_remaining_quantities(done_qtys=True)
diff --git a/odoo/addons/base/ir/ir_autovacuum.py b/odoo/addons/base/ir/ir_autovacuum.py
index a85f82af6a9..67880e72e23 100644
--- a/odoo/addons/base/ir/ir_autovacuum.py
+++ b/odoo/addons/base/ir/ir_autovacuum.py
@@ -4,6 +4,7 @@
 import logging
 
 from odoo import api, models
+from odoo.exceptions import AccessDenied
 
 _logger = logging.getLogger(__name__)
 
@@ -36,6 +37,8 @@ class AutoVacuum(models.AbstractModel):
 
     @api.model
     def power_on(self):
+        if not self.env.user._is_admin():
+            raise AccessDenied()
         self.env['ir.attachment']._file_gc()
         self._gc_transient_models()
         self._gc_user_logs()