diff --git a/addons/account/partner.py b/addons/account/partner.py
index 40d8702de16..5c55472861b 100644
--- a/addons/account/partner.py
+++ b/addons/account/partner.py
@@ -276,6 +276,7 @@ class res_partner(osv.osv):
                          AND cr.currency_id = %%s
                          AND (COALESCE(account_invoice_report.date, NOW()) >= cr.date_start)
                          AND (COALESCE(account_invoice_report.date, NOW()) < cr.date_end OR cr.date_end IS NULL)
+                         AND account_invoice_report.type in ('out_invoice', 'out_refund')
                     """ % where_clause
 
             # price_total is in the currency with rate = 1
diff --git a/addons/portal/wizard/portal_wizard.py b/addons/portal/wizard/portal_wizard.py
index 07ba018ab45..77cce3171f1 100644
--- a/addons/portal/wizard/portal_wizard.py
+++ b/addons/portal/wizard/portal_wizard.py
@@ -159,12 +159,15 @@ class wizard_user(osv.osv_memory):
         return error_msg
 
     def action_apply(self, cr, uid, ids, context=None):
+        self.pool['res.partner'].check_access_rights(cr, uid, 'write')
         error_msg = self.get_error_messages(cr, uid, ids, context=context)
         if error_msg:
             raise UserError( "\n\n".join(error_msg))
 
         for wizard_user in self.browse(cr, SUPERUSER_ID, ids, context):
             portal = wizard_user.wizard_id.portal_id
+            if not portal.is_portal:
+               raise osv.except_osv("Error", "Not a portal: " + portal.name)
             user = self._retrieve_user(cr, SUPERUSER_ID, wizard_user, context)
             if wizard_user.partner_id.email != wizard_user.email:
                 wizard_user.partner_id.write({'email': wizard_user.email})
diff --git a/addons/product/report/product_pricelist.py b/addons/product/report/product_pricelist.py
index cc59621e858..f3b0933a5b3 100644
--- a/addons/product/report/product_pricelist.py
+++ b/addons/product/report/product_pricelist.py
@@ -22,6 +22,7 @@
 import time
 from openerp.osv import osv
 from openerp.report import report_sxw
+from openerp.tools import float_round
 
 
 class product_pricelist(report_sxw.rml_parse):
@@ -106,10 +107,11 @@ class product_pricelist(report_sxw.rml_parse):
         pricelist = self.pool.get('product.pricelist').browse(self.cr, self.uid, [pricelist_id], context=self.localcontext)[0]
         price_dict = self.pool.get('product.pricelist').price_get(self.cr, self.uid, [pricelist_id], product_id, qty, context=self.localcontext)
         if price_dict[pricelist_id]:
-            price = self.formatLang(price_dict[pricelist_id], digits=sale_price_digits, currency_obj=pricelist.currency_id)
+            price = float_round(price_dict[pricelist_id], precision_digits=sale_price_digits)
         else:
             res = self.pool.get('product.product').read(self.cr, self.uid, [product_id])
-            price =  self.formatLang(res[0]['list_price'], digits=sale_price_digits, currency_obj=pricelist.currency_id)
+            price = float_round(res[0]['list_price'], precision_digits=sale_price_digits)
+        price = self.formatLang(price, digits=sale_price_digits, currency_obj=pricelist.currency_id)
         return price
 
 
diff --git a/openerp/http.py b/openerp/http.py
index 7f04f0691fc..ee5bbb35fba 100644
--- a/openerp/http.py
+++ b/openerp/http.py
@@ -162,6 +162,7 @@ def redirect_with_hash(url, code=303):
     # See extensive test page at http://greenbytes.de/tech/tc/httpredirects/
     if request.httprequest.user_agent.browser in ('firefox',):
         return werkzeug.utils.redirect(url, code)
+    url = url.replace("'", "%27").replace("<", "%3C")
     return "<html><head><script>window.location = '%s' + location.hash;</script></head></html>" % url
 
 class WebRequest(object):