diff --git a/addons/account/account.py b/addons/account/account.py
index ea0b98e26bf..50b922d723b 100644
--- a/addons/account/account.py
+++ b/addons/account/account.py
@@ -2874,10 +2874,12 @@ class wizard_multi_charts_accounts(osv.osv_memory):
                     obj_ac_fp.create(cr, uid, vals_acc)
 
         ir_values = self.pool.get('ir.values')
-        ir_values.set(cr, uid, key='default', key2=False, name="taxes_id", company=obj_multi.company_id.id
-                      , models =[('product.product',False)], value=[tax_template_to_tax[obj_multi.sale_tax.id]])
-        ir_values.set(cr, uid, key='default', key2=False, name="supplier_taxes_id", company=obj_multi.company_id.id
-                      , models =[('product.product',False)], value=[tax_template_to_tax[obj_multi.purchase_tax.id]])
+        if obj_multi.sale_tax:
+            ir_values.set(cr, uid, key='default', key2=False, name="taxes_id", company=obj_multi.company_id.id,
+                            models =[('product.product',False)], value=[tax_template_to_tax[obj_multi.sale_tax.id]])
+        if obj_multi.purchase_tax:
+            ir_values.set(cr, uid, key='default', key2=False, name="supplier_taxes_id", company=obj_multi.company_id.id,
+                            models =[('product.product',False)], value=[tax_template_to_tax[obj_multi.purchase_tax.id]])
 
 wizard_multi_charts_accounts()
 
diff --git a/addons/hr/hr.py b/addons/hr/hr.py
index 3c65e79f11f..0f499c43ddd 100644
--- a/addons/hr/hr.py
+++ b/addons/hr/hr.py
@@ -25,6 +25,8 @@ from osv import fields, osv
 import tools
 from tools.translate import _
 
+import addons
+
 class hr_employee_category(osv.osv):
 
     def name_get(self, cr, uid, ids, context=None):
@@ -180,9 +182,8 @@ class hr_employee(osv.osv):
         return {'value': {'work_email' : work_email}}
 
     def _get_photo(self, cr, uid, context=None):
-        return open(os.path.join(
-            tools.config['addons_path'], 'hr/image', 'photo.png'),
-                    'rb') .read().encode('base64')
+        res_path = addons.get_module_resource("hr","image/photo.png")
+        return open(res_path,'rb').read().encode('base64')
 
     _defaults = {
         'active': 1,
diff --git a/addons/l10n_be/account_pcmn_belgium.xml b/addons/l10n_be/account_pcmn_belgium.xml
index dc6c86fc9fa..3471a184d62 100644
--- a/addons/l10n_be/account_pcmn_belgium.xml
+++ b/addons/l10n_be/account_pcmn_belgium.xml
@@ -6718,6 +6718,7 @@
             <field name="ref_base_code_id" ref="vat_code_a49"/>
             <field name="ref_tax_code_id" ref="vat_code_a64"/>
             <field name="type_tax_use">sale</field>
+            <field name="sequence">0</field>
         </record>
         <record id="vat_21_s" model="account.tax.template">
             <field name="chart_template_id" ref="l10nbe_chart_template"/>
diff --git a/addons/project/project.py b/addons/project/project.py
index 294c711eaac..6c9f66dd009 100644
--- a/addons/project/project.py
+++ b/addons/project/project.py
@@ -483,7 +483,10 @@ class task(osv.osv):
 
     def fields_view_get(self, cr, uid, view_id=None, view_type='form', context=None, toolbar=False, submenu=False):
         users_obj = self.pool.get('res.users')
-        obj_tm = users_obj.browse(cr, uid, uid, context).company_id.project_time_mode_id
+
+        # read uom as admin to avoid access rights issues, e.g. for portal/share users,
+        # this should be safe (no context passed to avoid side-effects)
+        obj_tm = users_obj.browse(cr, 1, uid).company_id.project_time_mode_id
         tm = obj_tm and obj_tm.name or 'Hours'
 
         res = super(task, self).fields_view_get(cr, uid, view_id, view_type, context, toolbar, submenu=submenu)
diff --git a/addons/share/wizard/share_wizard.py b/addons/share/wizard/share_wizard.py
index 2d1fd252ecf..9349980933f 100644
--- a/addons/share/wizard/share_wizard.py
+++ b/addons/share/wizard/share_wizard.py
@@ -290,7 +290,7 @@ class share_create(osv.osv_memory):
         user_obj = self.pool.get('res.users')
         result_obj = self.pool.get('share.wizard.result.line')
         share_root_url = wizard_data.share_root_url
-        format_url = '%(login)' in share_root_url and '%(password)' in share_root_url
+        format_url = '%(login)s' in share_root_url and '%(password)s' in share_root_url
         existing_passwd_str = _('*usual password*')
         if wizard_data.user_type == 'new':
             for email in wizard_data.new_users.split('\n'):
@@ -430,7 +430,7 @@ class share_create(osv.osv_memory):
                 else:
                     body += _("This additional data has been automatically added to your current access.\n")
                     body += _("You may use your existing login and password to view it. As a reminder, your login is %s.\n") % result_line.login
-    
+
                 if not tools.email_send(
                                             user.user_email,
                                             email_to,
diff --git a/addons/share/wizard/share_wizard_view.xml b/addons/share/wizard/share_wizard_view.xml
index e6cade91c84..95fbc983c84 100644
--- a/addons/share/wizard/share_wizard_view.xml
+++ b/addons/share/wizard/share_wizard_view.xml
@@ -90,7 +90,7 @@
                     - 'action_id' (id of action)
                     - 'domain' (string expression for full domain to apply as sent to server, 
                                with dynamic data like 'uid' replaced by actual value (i.e. after eval)!)
-                    - 'share_root_url' : URL for direct access to share page (may include %(login) and %(password) placeholders)
+                    - 'share_root_url' : URL for direct access to share page (may include %(login)s and %(password)s placeholders)
          -->
         <record id="action_share_wizard" model="ir.actions.act_window">
             <field name="name">Share Wizard</field>
@@ -106,7 +106,7 @@
                     - 'action_id' (id of action)
                     - 'domain' (string expression for full domain to apply as sent to server, 
                                with dynamic data like 'uid' replaced by actual value (i.e. after eval)!)
-                    - 'share_root_url' : URL for direct access to share page (may include %(login) and %(password) placeholders)
+                    - 'share_root_url' : URL for direct access to share page (may include %(login)s and %(password)s placeholders)
          -->
         <record id="action_share_wizard_step1" model="ir.actions.act_window">
             <field name="name">Share Wizard</field>