diff --git a/addons/payment_adyen/models/adyen.py b/addons/payment_adyen/models/adyen.py
index d8d06042365..30dd036d65b 100644
--- a/addons/payment_adyen/models/adyen.py
+++ b/addons/payment_adyen/models/adyen.py
@@ -36,9 +36,9 @@ class AcquirerAdyen(osv.Model):
         return providers
 
     _columns = {
-        'adyen_merchant_account': fields.char('Merchant Account', required_if_provider='adyen'),
-        'adyen_skin_code': fields.char('Skin Code', required_if_provider='adyen'),
-        'adyen_skin_hmac_key': fields.char('Skin HMAC Key', required_if_provider='adyen'),
+        'adyen_merchant_account': fields.char('Merchant Account', required_if_provider='adyen', groups='base.group_user'),
+        'adyen_skin_code': fields.char('Skin Code', required_if_provider='adyen', groups='base.group_user'),
+        'adyen_skin_hmac_key': fields.char('Skin HMAC Key', required_if_provider='adyen', groups='base.group_user'),
     }
 
     def _adyen_generate_merchant_sig_sha256(self, acquirer, inout, values):
diff --git a/addons/payment_authorize/models/authorize.py b/addons/payment_authorize/models/authorize.py
index 39575961969..b74edfcc539 100644
--- a/addons/payment_authorize/models/authorize.py
+++ b/addons/payment_authorize/models/authorize.py
@@ -30,8 +30,8 @@ class PaymentAcquirerAuthorize(models.Model):
         providers.append(['authorize', 'Authorize.Net'])
         return providers
 
-    authorize_login = fields.Char(string='API Login Id', required_if_provider='authorize')
-    authorize_transaction_key = fields.Char(string='API Transaction Key', required_if_provider='authorize')
+    authorize_login = fields.Char(string='API Login Id', required_if_provider='authorize', groups='base.group_user')
+    authorize_transaction_key = fields.Char(string='API Transaction Key', required_if_provider='authorize', groups='base.group_user')
 
     def _authorize_generate_hashing(self, values):
         data = '^'.join([
diff --git a/addons/payment_buckaroo/models/buckaroo.py b/addons/payment_buckaroo/models/buckaroo.py
index 0dd11ae0750..bcadb70b84d 100644
--- a/addons/payment_buckaroo/models/buckaroo.py
+++ b/addons/payment_buckaroo/models/buckaroo.py
@@ -44,8 +44,8 @@ class AcquirerBuckaroo(osv.Model):
         return providers
 
     _columns = {
-        'brq_websitekey': fields.char('WebsiteKey', required_if_provider='buckaroo'),
-        'brq_secretkey': fields.char('SecretKey', required_if_provider='buckaroo'),
+        'brq_websitekey': fields.char('WebsiteKey', required_if_provider='buckaroo', groups='base.group_user'),
+        'brq_secretkey': fields.char('SecretKey', required_if_provider='buckaroo', groups='base.group_user'),
     }
 
     def _buckaroo_generate_digital_sign(self, acquirer, inout, values):
diff --git a/addons/payment_ogone/models/ogone.py b/addons/payment_ogone/models/ogone.py
index 585ad5a09ba..46a733d3735 100644
--- a/addons/payment_ogone/models/ogone.py
+++ b/addons/payment_ogone/models/ogone.py
@@ -47,11 +47,11 @@ class PaymentAcquirerOgone(osv.Model):
         return providers
 
     _columns = {
-        'ogone_pspid': fields.char('PSPID', required_if_provider='ogone'),
-        'ogone_userid': fields.char('API User ID', required_if_provider='ogone'),
-        'ogone_password': fields.char('API User Password', required_if_provider='ogone'),
-        'ogone_shakey_in': fields.char('SHA Key IN', size=32, required_if_provider='ogone'),
-        'ogone_shakey_out': fields.char('SHA Key OUT', size=32, required_if_provider='ogone'),
+        'ogone_pspid': fields.char('PSPID', required_if_provider='ogone', groups='base.group_user'),
+        'ogone_userid': fields.char('API User ID', required_if_provider='ogone', groups='base.group_user'),
+        'ogone_password': fields.char('API User Password', required_if_provider='ogone', groups='base.group_user'),
+        'ogone_shakey_in': fields.char('SHA Key IN', size=32, required_if_provider='ogone', groups='base.group_user'),
+        'ogone_shakey_out': fields.char('SHA Key OUT', size=32, required_if_provider='ogone', groups='base.group_user'),
         'ogone_alias_usage': fields.char('Alias Usage', help="""If you want to use Ogone Aliases,
                                                                 this default Alias Usage will be presented to
                                                                 the customer as the reason you want to
diff --git a/addons/payment_paypal/models/paypal.py b/addons/payment_paypal/models/paypal.py
index aacfbed5590..27cb88649c4 100644
--- a/addons/payment_paypal/models/paypal.py
+++ b/addons/payment_paypal/models/paypal.py
@@ -39,17 +39,17 @@ class AcquirerPaypal(osv.Model):
         return providers
 
     _columns = {
-        'paypal_email_account': fields.char('Paypal Email ID', required_if_provider='paypal'),
+        'paypal_email_account': fields.char('Paypal Email ID', required_if_provider='paypal', groups='base.group_user'),
         'paypal_seller_account': fields.char(
-            'Paypal Merchant ID',
+            'Paypal Merchant ID', groups='base.group_user',
             help='The Merchant ID is used to ensure communications coming from Paypal are valid and secured.'),
-        'paypal_use_ipn': fields.boolean('Use IPN', help='Paypal Instant Payment Notification'),
+        'paypal_use_ipn': fields.boolean('Use IPN', help='Paypal Instant Payment Notification', groups='base.group_user'),
         # Server 2 server
         'paypal_api_enabled': fields.boolean('Use Rest API'),
-        'paypal_api_username': fields.char('Rest API Username'),
-        'paypal_api_password': fields.char('Rest API Password'),
-        'paypal_api_access_token': fields.char('Access Token'),
-        'paypal_api_access_token_validity': fields.datetime('Access Token Validity'),
+        'paypal_api_username': fields.char('Rest API Username', groups='base.group_user'),
+        'paypal_api_password': fields.char('Rest API Password', groups='base.group_user'),
+        'paypal_api_access_token': fields.char('Access Token', groups='base.group_user'),
+        'paypal_api_access_token_validity': fields.datetime('Access Token Validity', groups='base.group_user'),
     }
 
     _defaults = {
diff --git a/addons/payment_sips/controllers/main.py b/addons/payment_sips/controllers/main.py
index 0bf4a5f52b3..02c975d94e2 100644
--- a/addons/payment_sips/controllers/main.py
+++ b/addons/payment_sips/controllers/main.py
@@ -32,7 +32,7 @@ class SipsController(http.Controller):
 
         sips = acquirer_obj.search([('provider', '=', 'sips')], limit=1)
 
-        security = sips._sips_generate_shasign(post)
+        security = sips.sudo()._sips_generate_shasign(post)
         if security == post['Seal']:
             _logger.debug('Sips: validated data')
             res = tx_obj.sudo().form_feedback(post, 'sips')
diff --git a/addons/payment_sips/models/sips.py b/addons/payment_sips/models/sips.py
index 9c74bf5ef06..506a9118ea6 100644
--- a/addons/payment_sips/models/sips.py
+++ b/addons/payment_sips/models/sips.py
@@ -38,8 +38,8 @@ class AcquirerSips(models.Model):
     _inherit = 'payment.acquirer'
     # Fields
     sips_merchant_id = fields.Char('SIPS API User Password',
-                                   required_if_provider='sips')
-    sips_secret = fields.Char('SIPS Secret', size=64, required_if_provider='sips')
+                                   required_if_provider='sips', groups='base.group_user')
+    sips_secret = fields.Char('SIPS Secret', size=64, required_if_provider='sips', groups='base.group_user')
 
     # Methods
     def _get_sips_urls(self, environment):
diff --git a/addons/web/controllers/main.py b/addons/web/controllers/main.py
index 09f2cd82313..cc62a287aca 100644
--- a/addons/web/controllers/main.py
+++ b/addons/web/controllers/main.py
@@ -98,7 +98,7 @@ def ensure_db(redirect='/web/database/selector'):
     # If the db is taken out of a query parameter, it will be checked against
     # `http.db_filter()` in order to ensure it's legit and thus avoid db
     # forgering that could lead to xss attacks.
-    db = request.params.get('db')
+    db = request.params.get('db') and request.params.get('db').strip()
 
     # Ensure db is legit
     if db and db not in http.db_filter([db]):
diff --git a/addons/website_payment/controllers/main.py b/addons/website_payment/controllers/main.py
index ee18815bb15..2ee7ee15c3d 100644
--- a/addons/website_payment/controllers/main.py
+++ b/addons/website_payment/controllers/main.py
@@ -46,7 +46,7 @@ class website_payment(http.Controller):
 
         partner_id = user.partner_id.id if user.partner_id.id != request.website.partner_id.id else False
 
-        payment_form = acquirer.render(reference, float(amount), currency.id, values={'return_url': '/website_payment/confirm', 'partner_id': partner_id})[0]
+        payment_form = acquirer.sudo().render(reference, float(amount), currency.id, values={'return_url': '/website_payment/confirm', 'partner_id': partner_id})[0]
         values = {
             'reference': reference,
             'acquirer': acquirer,