From 7009dce97c0b1481fd9fa4947599418f5bf22e6e Mon Sep 17 00:00:00 2001
From: John O'Nolan <john@tryghost.org>
Date: Wed, 16 Oct 2013 07:57:56 -0700
Subject: [PATCH 1/5] Merge pull request #1090 from bnchdrff/user-image-ff-fix

fixes firefox user image disappearance
---
 ghost/admin/assets/sass/layouts/users.scss | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ghost/admin/assets/sass/layouts/users.scss b/ghost/admin/assets/sass/layouts/users.scss
index 97f94b5b0d..d673a15ce2 100644
--- a/ghost/admin/assets/sass/layouts/users.scss
+++ b/ghost/admin/assets/sass/layouts/users.scss
@@ -206,8 +206,8 @@
 
         .img {
             display: block;
-            width: 100%;
-            height: 100%;
+            width: 110px;
+            height: 110px;
             background-image: url(/shared/img/user-image.png);
             background-size: cover;
             background-position: center center;
@@ -257,4 +257,4 @@
         color: darken($brown, 5%);
     }
 
-} //.settings
\ No newline at end of file
+} //.settings

From f8bcbdb44f69361f4a2244ab510935a067251a1b Mon Sep 17 00:00:00 2001
From: John O'Nolan <john@tryghost.org>
Date: Wed, 16 Oct 2013 17:26:28 +0200
Subject: [PATCH 2/5] Fixed further firefox display bugs

See #1090

Conflicts:
	core/client/tpl/settings/user-profile.hbs
---
 ghost/admin/assets/sass/layouts/users.scss | 9 ++++-----
 ghost/admin/tpl/settings/user-profile.hbs  | 6 +++---
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/ghost/admin/assets/sass/layouts/users.scss b/ghost/admin/assets/sass/layouts/users.scss
index d673a15ce2..a7d8a1afa0 100644
--- a/ghost/admin/assets/sass/layouts/users.scss
+++ b/ghost/admin/assets/sass/layouts/users.scss
@@ -221,15 +221,14 @@
     }
 
     .edit-user-image {
-        position: absolute;
-        top: 0;
-        width: 100%;
-        height: 100%;
-        display: block;
+        @include position(absolute, 0px 0px 0px 0px);
         border-radius: 100%;
         background: rgba(0,0,0,0.5);
         opacity: 0;
         color: #fff;
+        line-height: 105px;
+        text-transform: uppercase;
+        text-decoration: none;
         @include transition(opacity 0.3s ease);
     }
 
diff --git a/ghost/admin/tpl/settings/user-profile.hbs b/ghost/admin/tpl/settings/user-profile.hbs
index 12255a8f27..04106d3d5f 100644
--- a/ghost/admin/tpl/settings/user-profile.hbs
+++ b/ghost/admin/tpl/settings/user-profile.hbs
@@ -10,7 +10,7 @@
 
     <header class="user-profile-header">
         <img id="user-cover" class="cover-image" src="{{#if cover}}{{cover}}{{else}}/shared/img/user-cover.png{{/if}}" title="{{name}}'s Cover Image"/>
-        <button class="edit-cover-image js-modal-cover">Change Cover</button>
+        <a class="edit-cover-image js-modal-cover button" href="#">Change Cover</a>
     </header>
 
     <form class="user-profile" novalidate="novalidate">
@@ -18,8 +18,8 @@
         <fieldset class="user-details-top">
 
             <figure class="user-image">
-                <a id="user-image" class="img" {{#if image}}style="background-image: url({{image}});"{{/if}} href="#"><span class="hidden">{{name}}'s Picture</span></a>
-                <button class="edit-user-image js-modal-image">Edit Picture</button>
+                <div id="user-image" class="img" {{#if image}}style="background-image: url({{image}});"{{/if}} href="#"><span class="hidden">{{name}}'s Picture</span></div>
+                <a href="#" class="edit-user-image js-modal-image">Edit Picture</a>
             </figure>
 
             <div class="form-group">

From f1ef797d6bb13ec8809f53f37cf88628a8db9155 Mon Sep 17 00:00:00 2001
From: Sebastian Gierlinger <s.gierlinger@me.com>
Date: Thu, 17 Oct 2013 15:28:28 +0200
Subject: [PATCH 3/5] Security improvements

no issue
- added CSRF protection
- changed session handling to express.session
- changed session handling to change session id
- added config property useCookieSession
- added file extension check for /ghost/upload
- removed /ghost/debug/db/reset
---
 ghost/admin/assets/lib/uploader.js |  3 +++
 ghost/admin/init.js                | 10 ++++++++++
 ghost/admin/views/base.js          |  6 ++++++
 ghost/admin/views/login.js         |  9 +++++++++
 ghost/admin/views/settings.js      |  3 +++
 5 files changed, 31 insertions(+)

diff --git a/ghost/admin/assets/lib/uploader.js b/ghost/admin/assets/lib/uploader.js
index 28ecc9af34..2381271c32 100644
--- a/ghost/admin/assets/lib/uploader.js
+++ b/ghost/admin/assets/lib/uploader.js
@@ -64,6 +64,9 @@
 
                 $dropzone.find('.js-fileupload').fileupload().fileupload("option", {
                     url: '/ghost/upload/',
+                    headers: {
+                        'X-CSRF-Token': $("meta[name='csrf-param']").attr('content')
+                    },
                     add: function (e, data) {
                         $dropzone.find('.js-fileupload').removeClass('right');
                         $dropzone.find('.js-url, button.centre').remove();
diff --git a/ghost/admin/init.js b/ghost/admin/init.js
index 77ca1043e9..5f1ab7a825 100644
--- a/ghost/admin/init.js
+++ b/ghost/admin/init.js
@@ -23,6 +23,16 @@
 
     _.extend(Ghost, Backbone.Events);
 
+    Backbone.oldsync = Backbone.sync;
+    // override original sync method to make header request contain csrf token
+    Backbone.sync = function (method, model, options, error) {
+        options.beforeSend = function (xhr) {
+            xhr.setRequestHeader('X-CSRF-Token', $("meta[name='csrf-param']").attr('content'));
+        };
+        /* call the old sync method */
+        return Backbone.oldsync(method, model, options, error);
+    };
+
     Ghost.init = function () {
         Ghost.router = new Ghost.Router();
 
diff --git a/ghost/admin/views/base.js b/ghost/admin/views/base.js
index f530000d59..56f9a70a4d 100644
--- a/ghost/admin/views/base.js
+++ b/ghost/admin/views/base.js
@@ -202,6 +202,9 @@
             if (self.className.indexOf('notification-persistent') !== -1) {
                 $.ajax({
                     type: "DELETE",
+                    headers: {
+                        'X-CSRF-Token': $("meta[name='csrf-param']").attr('content')
+                    },
                     url: '/api/v0.1/notifications/' + $(self).find('.close').data('id')
                 }).done(function (result) {
                     bbSelf.$el.slideUp(250, function () {
@@ -231,6 +234,9 @@
                 bbSelf = this;
             $.ajax({
                 type: "DELETE",
+                headers: {
+                    'X-CSRF-Token': $("meta[name='csrf-param']").attr('content')
+                },
                 url: '/api/v0.1/notifications/' + $(self).data('id')
             }).done(function (result) {
                 var height = bbSelf.$('.js-notification').outerHeight(true),
diff --git a/ghost/admin/views/login.js b/ghost/admin/views/login.js
index 9cbdbce012..e16a5531db 100644
--- a/ghost/admin/views/login.js
+++ b/ghost/admin/views/login.js
@@ -33,6 +33,9 @@
                 $.ajax({
                     url: '/ghost/signin/',
                     type: 'POST',
+                    headers: {
+                        'X-CSRF-Token': $("meta[name='csrf-param']").attr('content')
+                    },
                     data: {
                         email: email,
                         password: password,
@@ -87,6 +90,9 @@
                 $.ajax({
                     url: '/ghost/signup/',
                     type: 'POST',
+                    headers: {
+                        'X-CSRF-Token': $("meta[name='csrf-param']").attr('content')
+                    },
                     data: {
                         name: name,
                         email: email,
@@ -136,6 +142,9 @@
                 $.ajax({
                     url: '/ghost/forgotten/',
                     type: 'POST',
+                    headers: {
+                        'X-CSRF-Token': $("meta[name='csrf-param']").attr('content')
+                    },
                     data: {
                         email: email
                     },
diff --git a/ghost/admin/views/settings.js b/ghost/admin/views/settings.js
index 3608adfa87..5d48b1340b 100644
--- a/ghost/admin/views/settings.js
+++ b/ghost/admin/views/settings.js
@@ -351,6 +351,9 @@
                 $.ajax({
                     url: '/ghost/changepw/',
                     type: 'POST',
+                    headers: {
+                        'X-CSRF-Token': $("meta[name='csrf-param']").attr('content')
+                    },
                     data: {
                         password: oldPassword,
                         newpassword: newPassword,

From c5431184bd8850ac1496c810f69fa509daa56c0f Mon Sep 17 00:00:00 2001
From: Hannah Wolfe <erisds@gmail.com>
Date: Thu, 17 Oct 2013 20:49:48 +0100
Subject: [PATCH 4/5] Fixes for content screen

fixes #1125

- fixes an error in the console when there are no posts
- resolves the issue whereby content disappears after scroll
---
 ghost/admin/views/blog.js | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ghost/admin/views/blog.js b/ghost/admin/views/blog.js
index 6d4bb754e2..34bd756d24 100644
--- a/ghost/admin/views/blog.js
+++ b/ghost/admin/views/blog.js
@@ -35,7 +35,7 @@
 
         showNext: function () {
             if (this.isLoading) { return; }
-            var id = this.collection.at(0).id;
+            var id = this.collection.at(0) ? this.collection.at(0).id : false;
             if (id) {
                 Backbone.trigger('blog:activeItem', id);
             }
@@ -77,6 +77,8 @@
             this.isLoading = true;
 
             this.collection.fetch({
+                update: true,
+                remove: false,
                 data: {
                     status: 'all',
                     page: (self.collection.currentPage + 1),

From a60fa5f970d64381fd3c6d82fbe6922891dd9a19 Mon Sep 17 00:00:00 2001
From: Hannah Wolfe <erisds@gmail.com>
Date: Thu, 17 Oct 2013 21:54:51 +0100
Subject: [PATCH 5/5] Fixing URL-based image uploads on settings screen

---
 ghost/admin/views/settings.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/ghost/admin/views/settings.js b/ghost/admin/views/settings.js
index 5d48b1340b..d945471d2f 100644
--- a/ghost/admin/views/settings.js
+++ b/ghost/admin/views/settings.js
@@ -204,8 +204,8 @@
             var self = this, upload = new Ghost.Models.uploadModal({'key': key, 'src': src, 'accept': {
                 func: function () { // The function called on acceptance
                     var data = {};
-                    if (this.$('#uploadurl').val()) {
-                        data[key] = this.$('#uploadurl').val();
+                    if (this.$('.js-upload-url').val()) {
+                        data[key] = this.$('.js-upload-url').val();
                     } else {
                         data[key] = this.$('.js-upload-target').attr('src');
                     }
@@ -263,8 +263,8 @@
             var self = this, upload = new Ghost.Models.uploadModal({'key': key, 'src': src, 'accept': {
                 func: function () { // The function called on acceptance
                     var data = {};
-                    if (this.$('#uploadurl').val()) {
-                        data[key] = this.$('#uploadurl').val();
+                    if (this.$('.js-upload-url').val()) {
+                        data[key] = this.$('.js-upload-url').val();
                     } else {
                         data[key] = this.$('.js-upload-target').attr('src');
                     }