diff --git a/addons/website/controllers/main.py b/addons/website/controllers/main.py
index 083f9f3aef7..30f384a606b 100644
--- a/addons/website/controllers/main.py
+++ b/addons/website/controllers/main.py
@@ -218,8 +218,7 @@ class Website(openerp.addons.web.controllers.main.Home):
         irt._get_source.clear_cache(irt) # FIXME: find why ir.translation does not invalidate
         return True
 
-    #  # FIXME: auth, anybody can upload an attachment if URL known/found
-    @website.route('/website/attach', type='http', auth='admin')
+    @website.route('/website/attach', type='http', auth='user')
     def attach(self, func, upload):
         req = request.httprequest
         if req.method != 'POST':
@@ -229,12 +228,18 @@ class Website(openerp.addons.web.controllers.main.Home):
         try:
             attachment_id = request.registry['ir.attachment'].create(request.cr, request.uid, {
                 'name': upload.filename,
-                'datas': base64.encodestring(upload.read()),
+                'datas': upload.read().encode('base64'),
                 'datas_fname': upload.filename,
                 'res_model': 'ir.ui.view',
             }, request.context)
-            # FIXME: auth=user... no good.
-            url = '/website/attachment/%d' % attachment_id
+
+            url = website.urlplus('/website/image', {
+                'model': 'ir.attachment',
+                'id': attachment_id,
+                'field': 'datas',
+                'max_height': MAX_IMAGE_HEIGHT,
+                'max_width': MAX_IMAGE_WIDTH,
+            })
         except Exception, e:
             logger.exception("Failed to upload image to attachment")
             message = str(e)
@@ -283,7 +288,7 @@ class Images(http.Controller):
             return response.make_conditional(request.httprequest)
 
     @website.route('/website/image', auth="public")
-    def image(self, model, id, field):
+    def image(self, model, id, field, max_width=maxint, max_height=maxint):
         Model = request.registry[model]
 
         response = werkzeug.wrappers.Response()
@@ -291,7 +296,7 @@ class Images(http.Controller):
         id = int(id)
 
         ids = Model.search(request.cr, request.uid,
-                           [('id', '=', id)], context=request.context)\
+                           [('id', '=', id)], context=request.context) \
             or Model.search(request.cr, openerp.SUPERUSER_ID,
                             [('id', '=', id), ('website_published', '=', True)], context=request.context)
 
@@ -312,8 +317,8 @@ class Images(http.Controller):
                 response.last_modified = datetime.datetime.strptime(
                     record[concurrency], server_format)
 
+        # Field does not exist on model or field set to False
         if not record.get(field):
-            # Field does not exist on model or field set to False
             # FIXME: maybe a field which does not exist should be a 404?
             return self.placeholder(response)
 
@@ -324,19 +329,9 @@ class Images(http.Controller):
         if response.status_code == 304:
             return response
 
-        return self.set_image_data(response, record[field].decode('base64'))
-
-    # FIXME: auth
-    # FIXME: delegate to image?
-    @website.route('/website/attachment/<int:id>', auth='admin')
-    def attachment(self, id):
-        attachment = request.registry['ir.attachment'].browse(
-            request.cr, request.uid, id, request.context)
-
         return self.set_image_data(
-            werkzeug.wrappers.Response(),
-            attachment.datas.decode('base64'),
-            fit=IMAGE_LIMITS,)
+            response, record[field].decode('base64'),
+            fit=(int(max_width), int(max_height)))
 
     def set_image_data(self, response, data, fit=(maxint, maxint)):
         """ Sets an inferred mime type on the response object, and puts the
@@ -356,10 +351,13 @@ class Images(http.Controller):
 
         if w < max_w and h < max_h:
             response.set_data(data)
-            return response
+        else:
+            image.thumbnail(fit, Image.ANTIALIAS)
+            image.save(response.stream, image.format)
+            # invalidate content-length computed by make_conditional as writing
+            # to response.stream does not do it (as of werkzeug 0.9.3)
+            del response.headers['Content-Length']
 
-        image.thumbnail(fit, Image.ANTIALIAS)
-        image.save(response.stream, image.format)
         return response
 
 
diff --git a/addons/website/models/ir_qweb.py b/addons/website/models/ir_qweb.py
index d6bd6a524c3..d7bd704b895 100644
--- a/addons/website/models/ir_qweb.py
+++ b/addons/website/models/ir_qweb.py
@@ -12,6 +12,7 @@ import itertools
 import logging
 import re
 import urllib2
+import urlparse
 
 import werkzeug.utils
 from dateutil import parser
@@ -199,10 +200,11 @@ class Image(orm.AbstractModel):
     def from_html(self, cr, uid, model, column, element, context=None):
         url = element.find('img').get('src')
 
-        m = re.match(r'^/website/attachment/(\d+)$', url)
-        if m:
+        url_object = urlparse.urlsplit(url)
+        query = urlparse.parse_qs(url_object.query)
+        if url_object.path == '/website/image' and query['model'] == 'ir.attachment':
             attachment = self.pool['ir.attachment'].browse(
-                cr, uid, int(m.group(1)), context=context)
+                cr, uid, int(query['id']), context=context)
             return attachment.datas
 
         # remote URL?
diff --git a/addons/website/models/website.py b/addons/website/models/website.py
index 6d8d5f520a2..d7f47c01b25 100644
--- a/addons/website/models/website.py
+++ b/addons/website/models/website.py
@@ -364,13 +364,18 @@ class website(osv.osv):
 class ir_attachment(osv.osv):
     _inherit = "ir.attachment"
     def _website_url_get(self, cr, uid, ids, name, arg, context=None):
-        context = context or {}
         result = {}
         for attach in self.browse(cr, uid, ids, context=context):
-            if attach.type=='url':
+            if attach.type == 'url':
                 result[attach.id] = attach.url
             else:
-                result[attach.id] = "/website/attachment/"+str(attach.id)
+                result[attach.id] = urlplus('/website/image', {
+                    'model': 'ir.attachment',
+                    'field': 'datas',
+                    'id': attach.id,
+                    'max_width': 1024,
+                    'max_height': 768,
+                })
         return result
     _columns = {
         'website_url': fields.function(_website_url_get, string="Attachment URL", type='char')
diff --git a/addons/website/views/website_templates.xml b/addons/website/views/website_templates.xml
index e1b79446451..430ed49e08b 100644
--- a/addons/website/views/website_templates.xml
+++ b/addons/website/views/website_templates.xml
@@ -226,23 +226,24 @@
 
         <template id="publish_management">
             <t t-if="editable" t-ignore="true">
-            <div class="pull-right btn-group">
-              <div t-attf-class="btn-group dropdown js_publish_management #{object.id and object.website_published and 'css_publish' or 'css_unpublish'}" t-att-data-id="object.id" t-att-data-object="object._name">
-                <a t-attf-class="btn btn-xs btn-#{object.id and object.website_published and 'success' or 'default'}" t-att-id="'dopprod-%s' % object.id" role="button" data-toggle="dropdown">Options <span class="caret"></span></a>
-                <ul class="dropdown-menu" role="menu" t-att-aria-labelledby="'dopprod-%s' % object.id">
-                    <t t-raw="0"/>
-                    <li>
-                        <a href="#" class="js_publish_btn css_unpublish">Unpublish</a>
-                        <a href="#" class="js_publish_btn css_publish">Publish</a>
-                    </li>
-                    <li t-if="publish_duplicate">
-                        <a t-att-href="publish_duplicate">Duplicate</a>
-                    </li>
-                </ul>
-              </div>
-              <t t-if="publish_edit">
-                <a class="btn btn-xs btn-default" title="Edit in backend" t-att-href="'/web#model=%s&amp;id=%s' % (object._name, object.id)"><span t-attf-class="glyphicon glyphicon-wrench"></span></a>
-              </t>
+            <div class="pull-right">
+                <div t-attf-class="btn-group dropdown js_publish_management #{object.id and object.website_published and 'css_publish' or 'css_unpublish'}" t-att-data-id="object.id" t-att-data-object="object._name">
+                    <a t-attf-class="btn btn-sm btn-#{object.id and object.website_published and 'success' or 'default'}" t-att-id="'dopprod-%s' % object.id" role="button" data-toggle="dropdown">Options <span class="caret"></span></a>
+                    <ul class="dropdown-menu" role="menu" t-att-aria-labelledby="'dopprod-%s' % object.id">
+                        <t t-raw="0"/>
+                        <li>
+                            <a href="#" class="js_publish_btn css_unpublish">Unpublish</a>
+                            <a href="#" class="js_publish_btn css_publish">Publish</a>
+                        </li>
+                        <li t-if="publish_duplicate">
+                            <a t-att-href="publish_duplicate">Duplicate</a>
+                        </li>
+                        <li t-if="publish_edit">
+                            <a t-att-href="'/web#model=%s&amp;id=%s' % (object._name, object.id)"
+                            title='Edit in backend'>Edit</a>
+                        </li>
+                    </ul>
+                </div>
             </div>
             </t>
         </template>
diff --git a/addons/website_blog/models/website_blog.py b/addons/website_blog/models/website_blog.py
index 9ecfe6cafee..a8e81552ee2 100644
--- a/addons/website_blog/models/website_blog.py
+++ b/addons/website_blog/models/website_blog.py
@@ -79,7 +79,7 @@ class BlogPost(osv.Model):
                         'oe_expand_container_tag': 'div',
                         'oe_expand_container_class': 'oe_mail_expand text-center',
                         'oe_expand_container_content': '',
-                        'oe_expand_a_href': '/blog/%d/%d' % (page.category_id.id, page.id),
+                        'oe_expand_a_href': '/blog/%d/' % page.id,
                         'oe_expand_a_class': 'oe_mail_expand btn btn-info',
                         'oe_expand_separator_node': 'br',
                     },
diff --git a/addons/website_blog/views/website_blog_templates.xml b/addons/website_blog/views/website_blog_templates.xml
index 1ce018221c4..efbf22814d0 100644
--- a/addons/website_blog/views/website_blog_templates.xml
+++ b/addons/website_blog/views/website_blog_templates.xml
@@ -256,7 +256,7 @@
                 through your <b>blog entries</b>, referenced in Google.
             </p>
             <div>
-                <button src="/contactus" class="btn btn-primary">Contact us</button>
+                <a t-href="/page/website.contactus"><button class="btn btn-primary">Contact us</button></a>
             </div>
             </section>
         </xpath>
diff --git a/addons/website_sale/controllers/main.py b/addons/website_sale/controllers/main.py
index 8de0a0bb578..193bb079191 100644
--- a/addons/website_sale/controllers/main.py
+++ b/addons/website_sale/controllers/main.py
@@ -113,7 +113,7 @@ class Ecommerce(http.Controller):
         request.context['pricelist'] = self.get_pricelist()
 
         # search for checking of access rules and keep order
-        product_ids = [id for id in product_ids if id in product_obj.search(request.cr, request.uid, [("id", 'in', product_ids)], context=request.context)]
+        product_ids = product_obj.search(request.cr, request.uid, [("id", 'in', product_ids)], context=request.context)
 
         size_ids = {}
         style_ids = style_obj.search(request.cr, SUPERUSER_ID, [('html_class', 'like', 'size_%')], context=request.context)
@@ -212,6 +212,7 @@ class Ecommerce(http.Controller):
                 col += 1
             line += 1
 
+        print bin_packing_list
         return bin_packing_list
 
     def get_products(self, product_ids):
@@ -272,6 +273,9 @@ class Ecommerce(http.Controller):
 
     @website.route(['/shop/', '/shop/page/<int:page>/'], type='http', auth="public", multilang=True)
     def category(self, category=0, attributes="", page=0, **post):
+        # TDE-NOTE: shouldn't we do somethign about product_template without variants ???
+        # TDE-NOTE: is there a reason to call a method category when the route is
+        # basically a shop without category_id speceified ?
 
         if 'promo' in post:
             self.change_pricelist(post.get('promo'))
diff --git a/addons/website_sale/models/product.py b/addons/website_sale/models/product.py
index e74dcda7ee4..9b4c388e929 100644
--- a/addons/website_sale/models/product.py
+++ b/addons/website_sale/models/product.py
@@ -35,10 +35,17 @@ class product_template(osv.Model):
     _name = 'product.template'
 
     def _website_url(self, cr, uid, ids, field_name, arg, context=None):
-        res = {}
+        """ TDE-NOTE: as someone wrote this method without any clue on about what it
+        does, fixing bugs about product_variant_ids not existing will be done
+        based on the weather, the sun and Lilo's feelings about pigs.
+
+        If you see this comment in trunk, this means that the website branch has
+        been merged without any review, which is quite questionable. """
+        res = dict.fromkeys(ids, '')
         base_url = self.pool.get('ir.config_parameter').get_param(cr, uid, 'web.base.url')
-        for prod in self.browse(cr, uid, ids, context=context):
-            res[prod.id] = "%s/shop/product/%s/" % (base_url, prod.product_variant_ids[0].id)
+        for product in self.browse(cr, uid, ids, context=context):
+            if product.product_variant_ids:
+                res[product.id] = "%s/shop/product/%s/" % (base_url, product.product_variant_ids[0].id)
         return res
 
     _columns = {
@@ -48,7 +55,7 @@ class product_template(osv.Model):
         'suggested_product_ids': fields.one2many('product.template', 'suggested_product_id', 'Suggested Products'),
         'website_size_x': fields.integer('Size X'),
         'website_size_y': fields.integer('Size Y'),
-        'website_style_ids' : fields.many2many('website.product.style','product_website_style_rel', 'product_id', 'style_id', 'Styles'),
+        'website_style_ids': fields.many2many('website.product.style', 'product_website_style_rel', 'product_id', 'style_id', 'Styles'),
         'website_sequence': fields.integer('Sequence', help="Determine the display order in the Website E-commerce"),
         'website_url': fields.function(_website_url, string="Website url"),
     }
diff --git a/addons/website_sale/views/website_sale.xml b/addons/website_sale/views/website_sale.xml
index c8585af266b..eb4c5fcf561 100644
--- a/addons/website_sale/views/website_sale.xml
+++ b/addons/website_sale/views/website_sale.xml
@@ -43,7 +43,7 @@
               <b t-field="product.name"/>
           </a>
       </div>
-      <div class="product_price">
+      <div class="product_price" t-if="product.product_variant_ids">
           <b>
               <t t-if="product.product_variant_ids[0].lst_price != product.product_variant_ids[0].price">
                 <del class="text-danger"
@@ -285,7 +285,7 @@
                               <br/>
                           </t>
 
-                          <div class="product_price mt16">
+                          <div class="product_price mt16" t-if="product.product_variant_ids">
                               <h4>
                                   <b><span class="oe_price" t-esc="product.product_variant_ids[0].price" /> €</b>
 
@@ -618,7 +618,7 @@
 
                 <div class="row">
                 <div class="col-md-8 oe_mycart">
-                    <h3 class="page-header mt16">Set Billing Information
+                    <h3 class="page-header mt16">Billing Information
                         <small t-if="user_id.id == website.public_user.id"> or
                             <a t-if="not partner" t-attf-href="/web#action=redirect&amp;url=#{ request.httprequest.host_url }/shop/checkout/">sign in</a>
                         </small>
@@ -749,10 +749,6 @@
                             "display_currency": "website.pricelist_id.currency_id"
                         }'/></h4></div>
                     </div>
-                    <button type="submit" class="btn btn-default btn-primary pull-right mt16" t-if="user_id.id != website.public_user.id">
-                        Confirm <span class="icon-long-arrow-right"/>
-                    </button>
-
                 </div>
             </div>
             </form>