ACL rule with id='access_account_fiscalyear' is accidentally specified twice in portal_sale/security/ir.model.access.csv file.
The first rule (for object account.sequence.fiscalyear) is hence not loaded.
A short Patch follows:
=== modified file 'portal_sale/security/ir.model.access.csv'
--- portal_sale/security/ir.model.access.csv 2012-12-05 14:40:51 +0000
+++ portal_sale/security/ir.model.access.csv 2014-02-22 17:46:16 +0000
@@ -10,7 +10,7 @@
access_account_move,account.move,account.model_account_move,portal.group_portal,1,0,0,0
access_account_move_line,account.move.line,account.model_account_move_line,portal.group_portal,1,0,0,0
access_account_move_reconcile,account.move.reconcile,account.model_account_move_reconcile,portal.group_portal,1,0,0,0
-access_account_fiscalyear,account.sequence.fiscalyear,account.model_account_sequence_fiscalyear,portal.group_portal,1,0,0,0
+access_account_sequence_fiscalyear,account.sequence.fiscalyear,account.model_account_sequence_fiscalyear,portal.group_portal,1,0,0,0
access_sale_shop,sale.shop,sale.model_sale_shop,portal.group_portal,1,0,0,0
access_product_list,product.pricelist,product.model_product_pricelist,portal.group_portal,1,0,0,0
access_res_partner,res.partner,base.model_res_partner,portal.group_portal,1,0,0,0
