=== modified file 'dhis-2/dhis-api/src/main/java/org/hisp/dhis/common/SharingUtils.java'
--- dhis-2/dhis-api/src/main/java/org/hisp/dhis/common/SharingUtils.java	2013-10-01 09:57:01 +0000
+++ dhis-2/dhis-api/src/main/java/org/hisp/dhis/common/SharingUtils.java	2013-10-01 10:06:54 +0000
@@ -214,7 +214,7 @@
         //TODO ( (object instanceof User) && canCreatePrivate( user, object ) ): review possible security breaches and best way to give update access upon user import
         if ( sharingOverrideAuthority( user )
             || (object.getUser() == null && canCreatePublic( user, object ) && PRIVATE_AUTHORITIES.get( object.getClass() ) != null)
-            || user.equals( object.getUser() )
+            || (user != null && user.equals( object.getUser() ))
             //|| authorities.contains( PRIVATE_AUTHORITIES.get( object.getClass() ) )
             || ((object instanceof User) && canCreatePrivate( user, object ))
             || AccessStringHelper.canWrite( object.getPublicAccess() ) )

=== modified file 'dhis-2/dhis-services/dhis-service-dxf2/src/main/java/org/hisp/dhis/dxf2/metadata/importers/DefaultIdentifiableObjectImporter.java'
--- dhis-2/dhis-services/dhis-service-dxf2/src/main/java/org/hisp/dhis/dxf2/metadata/importers/DefaultIdentifiableObjectImporter.java	2013-10-01 09:57:01 +0000
+++ dhis-2/dhis-services/dhis-service-dxf2/src/main/java/org/hisp/dhis/dxf2/metadata/importers/DefaultIdentifiableObjectImporter.java	2013-10-01 10:06:54 +0000
@@ -411,6 +411,7 @@
         nonIdentifiableObjects.extract( object );
 
         UserCredentials userCredentials = null;
+
         if ( object instanceof User )
         {
             userCredentials = ((User) object).getUserCredentials();
@@ -488,6 +489,7 @@
         nonIdentifiableObjects.delete( persistedObject );
 
         UserCredentials userCredentials = null;
+
         if ( object instanceof User )
         {
             userCredentials = ((User) object).getUserCredentials();