From 1d1caada6bf542eb2ec6f0a5cb3c2e018b8db150 Mon Sep 17 00:00:00 2001
From: Xie JinBin <xiexiecn@hotmail.com>
Date: Sun, 26 Jan 2014 12:32:08 +0800
Subject: [PATCH 01/10] bug caused by unidecode's bug

close #1986
- remove URL reserved chars after unidecode, because unidecode will produce some URL reserved chars.
---
 core/server/models/base.js | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/core/server/models/base.js b/core/server/models/base.js
index e03a164c41..3fd003a010 100644
--- a/core/server/models/base.js
+++ b/core/server/models/base.js
@@ -213,8 +213,13 @@ ghostBookshelf.Model = ghostBookshelf.Model.extend({
                 });
             };
 
+        slug = base.trim();
+
+        // Remove non ascii characters
+        slug = unidecode(slug);
+
         // Remove URL reserved chars: `:/?#[]@!$&'()*+,;=` as well as `\%<>|^~£"`
-        slug = base.trim().replace(/[:\/\?#\[\]@!$&'()*+,;=\\%<>\|\^~£"]/g, '')
+        slug = slug.replace(/[:\/\?#\[\]@!$&'()*+,;=\\%<>\|\^~£"]/g, '')
             // Replace dots and spaces with a dash
             .replace(/(\s|\.)/g, '-')
             // Convert 2 or more dashes into a single dash
@@ -224,8 +229,7 @@ ghostBookshelf.Model = ghostBookshelf.Model.extend({
 
         // Remove trailing hyphen
         slug = slug.charAt(slug.length - 1) === '-' ? slug.substr(0, slug.length - 1) : slug;
-        // Remove non ascii characters
-        slug = unidecode(slug);
+
         // Check the filtered slug doesn't match any of the reserved keywords
         slug = /^(ghost|ghost\-admin|admin|wp\-admin|wp\-login|dashboard|logout|login|signin|signup|signout|register|archive|archives|category|categories|tag|tags|page|pages|post|posts|user|users|rss)$/g
             .test(slug) ? slug + '-post' : slug;

From f3e67f9a76fb4e248e22a13dfb645082962628e8 Mon Sep 17 00:00:00 2001
From: Gabor Javorszky <gabor@javorszky.co.uk>
Date: Sun, 26 Jan 2014 22:38:50 +0000
Subject: [PATCH 02/10] Guard against multiple signup events

Fixes #1841
* Added initial flag "no" for submission into Signup View
* Flag set to "yes" if submit button clicked
* Error thrown if flag is "yes", thus no subsequent submission sent to API
* Flag set to "no" if ajax returns with error
---
 core/client/views/login.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/core/client/views/login.js b/core/client/views/login.js
index acf196f0f1..b73f872312 100644
--- a/core/client/views/login.js
+++ b/core/client/views/login.js
@@ -64,6 +64,7 @@
     Ghost.Views.Signup = Ghost.View.extend({
 
         initialize: function () {
+            this.submitted = "no";
             this.render();
         },
 
@@ -95,10 +96,12 @@
             Ghost.Validate.check(name, "Please enter a name").len(1);
             Ghost.Validate.check(email, "Please enter a correct email address").isEmail();
             Ghost.Validate.check(password, "Your password is not long enough. It must be at least 8 characters long.").len(8);
+            Ghost.Validate.check(this.submitted, "Ghost is signing you up. Please wait...").equals("no");
 
             if (Ghost.Validate._errors.length > 0) {
                 Ghost.Validate.handleErrors();
             } else {
+                this.submitted = "yes";
                 $.ajax({
                     url: Ghost.paths.subdir + '/ghost/signup/',
                     type: 'POST',
@@ -114,6 +117,7 @@
                         window.location.href = msg.redirect;
                     },
                     error: function (xhr) {
+                        this.submitted = "no";
                         Ghost.notifications.clearEverything();
                         Ghost.notifications.addItem({
                             type: 'error',

From 485ab376c0375683d59033b2180a3d401daaacad Mon Sep 17 00:00:00 2001
From: Hannah Wolfe <erisds@gmail.com>
Date: Sun, 26 Jan 2014 11:29:48 +0000
Subject: [PATCH 03/10] Post settings don't render on change

fixes #1908

- each individual update function handles rendering its own item on success or failure, rather than re-rendering the whole group
- also resolved a bug where the published date didn't get reset properly on error
---
 core/client/views/post-settings.js | 36 +++++++++++++++++++++---------
 1 file changed, 26 insertions(+), 10 deletions(-)

diff --git a/core/client/views/post-settings.js b/core/client/views/post-settings.js
index ad99dcc735..a1a487138a 100644
--- a/core/client/views/post-settings.js
+++ b/core/client/views/post-settings.js
@@ -5,6 +5,10 @@
 (function () {
     "use strict";
 
+    var parseDateFormats = ['DD MMM YY  HH:mm', 'DD MMM YYYY HH:mm', 'DD/MM/YY HH:mm', 'DD/MM/YYYY HH:mm',
+            'DD-MM-YY HH:mm', 'DD-MM-YYYY HH:mm'],
+        displayDateFormat = 'DD MMM YY @ HH:mm';
+
     Ghost.View.PostSettings = Ghost.View.extend({
 
         events: {
@@ -17,11 +21,10 @@
 
         initialize: function () {
             if (this.model) {
+                // These three items can be updated outside of the post settings menu, so have to be listened to.
                 this.listenTo(this.model, 'change:id', this.render);
-                this.listenTo(this.model, 'change:status', this.render);
-                this.listenTo(this.model, 'change:published_at', this.render);
-                this.listenTo(this.model, 'change:page', this.render);
                 this.listenTo(this.model, 'change:title', this.updateSlugPlaceholder);
+                this.listenTo(this.model, 'change:published_at', this.updatePublishedDate);
             }
         },
 
@@ -29,8 +32,7 @@
             var slug = this.model ? this.model.get('slug') : '',
                 pubDate = this.model ? this.model.get('published_at') : 'Not Published',
                 $pubDateEl = this.$('.post-setting-date'),
-                $postSettingSlugEl = this.$('.post-setting-slug'),
-                publishedDateFormat = 'DD MMM YY @ HH:mm';
+                $postSettingSlugEl = this.$('.post-setting-slug');
 
             $postSettingSlugEl.val(slug);
 
@@ -41,10 +43,10 @@
 
             // Insert the published date, and make it editable if it exists.
             if (this.model && this.model.get('published_at')) {
-                pubDate = moment(pubDate).format(publishedDateFormat);
+                pubDate = moment(pubDate).format(displayDateFormat);
                 $pubDateEl.attr('placeholder', '');
             } else {
-                $pubDateEl.attr('placeholder', moment().format(publishedDateFormat));
+                $pubDateEl.attr('placeholder', moment().format(displayDateFormat));
             }
 
             if (this.model && this.model.get('id')) {
@@ -130,6 +132,7 @@
                 },
                 error : function (model, xhr) {
                     /*jslint unparam:true*/
+                    slugEl.value = model.previous('slug');
                     Ghost.notifications.addItem({
                         type: 'error',
                         message: Ghost.Views.Utils.getRequestErrorMessage(xhr),
@@ -139,13 +142,23 @@
             });
         }, 500),
 
+
+        updatePublishedDate: function () {
+            var pubDate = this.model.get('published_at') ? moment(this.model.get('published_at'))
+                    .format(displayDateFormat) : '',
+                $pubDateEl = this.$('.post-setting-date');
+
+            // Only change the date if it's different
+            if (pubDate && $pubDateEl.val() !== pubDate) {
+                $pubDateEl.val(pubDate);
+            }
+        },
+
         editDate: _.debounce(function (e) {
             e.preventDefault();
             var self = this,
-                parseDateFormats = ['DD MMM YY HH:mm', 'DD MMM YYYY HH:mm', 'DD/MM/YY HH:mm', 'DD/MM/YYYY HH:mm', 'DD-MM-YY HH:mm', 'DD-MM-YYYY HH:mm'],
-                displayDateFormat = 'DD MMM YY @ HH:mm',
                 errMessage = '',
-                pubDate = self.model.get('published_at'),
+                pubDate = moment(self.model.get('published_at')).format(displayDateFormat),
                 pubDateEl = e.currentTarget,
                 newPubDate = pubDateEl.value,
                 pubDateMoment,
@@ -228,6 +241,8 @@
                 },
                 error : function (model, xhr) {
                     /*jslint unparam:true*/
+                    //  Reset back to original value
+                    pubDateEl.value = pubDateMoment ? pubDateMoment.format(displayDateFormat) : '';
                     Ghost.notifications.addItem({
                         type: 'error',
                         message: Ghost.Views.Utils.getRequestErrorMessage(xhr),
@@ -266,6 +281,7 @@
                 },
                 error : function (model, xhr) {
                     /*jslint unparam:true*/
+                    pageEl.prop('checked', model.previous('page'));
                     Ghost.notifications.addItem({
                         type: 'error',
                         message: Ghost.Views.Utils.getRequestErrorMessage(xhr),

From b9e426478d6ec3fb6711c28c697632f599082ae8 Mon Sep 17 00:00:00 2001
From: Hannah Wolfe <erisds@gmail.com>
Date: Mon, 27 Jan 2014 21:18:38 +0000
Subject: [PATCH 04/10] Add body class if update is available

issue #1995
---
 core/server/helpers/index.js                | 12 ++++++++----
 core/server/views/default.hbs               |  2 +-
 core/test/unit/server_helpers_index_spec.js | 17 +++++++++++++----
 3 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/core/server/helpers/index.js b/core/server/helpers/index.js
index add7d41d2e..97766e380a 100644
--- a/core/server/helpers/index.js
+++ b/core/server/helpers/index.js
@@ -562,7 +562,7 @@ coreHelpers.adminUrl = function (options) {
     return config.paths.urlFor(context, absolute);
 };
 
-coreHelpers.updateNotification = function () {
+coreHelpers.updateNotification = function (options) {
     var output = '';
 
     if (config().updateCheck === false || !this.currentUser) {
@@ -571,9 +571,13 @@ coreHelpers.updateNotification = function () {
 
     return updateCheck.showUpdateNotification().then(function (result) {
         if (result) {
-            output = '<div class="notification-success">' +
-                'A new version of Ghost is available! Hot damn. ' +
-                '<a href="http://ghost.org/download">Upgrade now</a></div>';
+            if (options && options.hash && options.hash.classOnly) {
+                output = ' update-available';
+            } else {
+                output = '<div class="notification-success">' +
+                    'A new version of Ghost is available! Hot damn. ' +
+                    '<a href="http://ghost.org/download">Upgrade now</a></div>';
+            }
         }
 
         return output;
diff --git a/core/server/views/default.hbs b/core/server/views/default.hbs
index 039387b6af..64ebe28105 100644
--- a/core/server/views/default.hbs
+++ b/core/server/views/default.hbs
@@ -31,7 +31,7 @@
     <link rel="stylesheet" href="{{asset "css/screen.css" ghost="true"}}">
     {{{block "pageStyles"}}}
 </head>
-<body class="{{bodyClass}}">
+    <body class="{{bodyClass}}{{updateNotification classOnly="true"}}">
     {{#unless hideNavbar}}
         {{> navbar}}
     {{/unless}}
diff --git a/core/test/unit/server_helpers_index_spec.js b/core/test/unit/server_helpers_index_spec.js
index 4c0fe070d0..f083b42eeb 100644
--- a/core/test/unit/server_helpers_index_spec.js
+++ b/core/test/unit/server_helpers_index_spec.js
@@ -940,21 +940,30 @@ describe('Core Helpers', function () {
     });
     describe('updateNotification', function () {
         it('outputs a correctly formatted notification when db version is higher than package version', function (done) {
-            var output = '<div class="notification-success">' +
+            var defaultOutput = '<div class="notification-success">' +
                 'A new version of Ghost is available! Hot damn. ' +
-                '<a href="http://ghost.org/download">Upgrade now</a></div>';
+                '<a href="http://ghost.org/download">Upgrade now</a></div>',
+                classOutput = ' update-available';
 
             apiStub.restore();
             apiStub = sandbox.stub(api.settings, 'read', function () {
                 var futureversion = packageInfo.version.split('.');
-                futureversion[futureversion.length-1] = parseInt(futureversion[futureversion.length-1], 10) + 1;
+                futureversion[futureversion.length - 1] = parseInt(futureversion[futureversion.length - 1], 10) + 1;
                 return when({value: futureversion.join('.')});
             });
 
             helpers.updateNotification.call({currentUser: {name: 'bob'}}).then(function (rendered) {
                 should.exist(rendered);
 
-                rendered.should.equal(output);
+                rendered.should.equal(defaultOutput);
+
+                // Test classOnly option
+                return helpers.updateNotification.call({currentUser: {name: 'bob'}}, {'hash': {'classOnly': 'true'}});
+            }).then(function (rendered) {
+                should.exist(rendered);
+
+                rendered.should.equal(classOutput);
+
                 done();
             }).then(null, done);
         });

From d45d036ecbdafa5655528ebe80acefa1aae7eb14 Mon Sep 17 00:00:00 2001
From: Mikkel Hoegh <mikkel@hoegh.org>
Date: Sun, 26 Jan 2014 18:52:16 +0100
Subject: [PATCH 05/10] Refactor click handlers on upload button.

closes #2028
- Instead of binding and unbinding the click event, bind the data to the
  outer scope so we can use a standard click handler.
- Use removeProp instead of setting the property to false when enabling.
- Use the `disabled` as value when disabling.
---
 core/client/views/debug.js | 37 +++++++++++++++++++++++++------------
 1 file changed, 25 insertions(+), 12 deletions(-)

diff --git a/core/client/views/debug.js b/core/client/views/debug.js
index 1b14616bc7..81fc29eba1 100644
--- a/core/client/views/debug.js
+++ b/core/client/views/debug.js
@@ -5,12 +5,17 @@
     Ghost.Views.Debug = Ghost.View.extend({
         events: {
             "click .settings-menu a": "handleMenuClick",
+            "click #startupload": "handleUploadClick",
             "click .js-delete": "handleDeleteClick"
         },
 
         initialize: function () {
+            var view = this;
+
+            this.uploadButton = this.$el.find('#startupload');
+
             // Disable import button and initizalize BlueImp file upload
-            $('#startupload').prop('disabled', true);
+            this.uploadButton.prop('disabled', 'disabled');
             $('#importfile').fileupload({
                 url: Ghost.paths.apiRoot + '/db/',
                 limitMultiFileUploads: 1,
@@ -21,16 +26,12 @@
                 dataType: 'json',
                 add: function (e, data) {
                     /*jslint unparam:true*/
-                    // unregister click event to preveng duplicate binding
-                    $('#startupload').off("click");
-                    data.context = $('#startupload').prop('disabled', false)
-                        .click(function () {
-                            $('#startupload').prop('disabled', true);
-                            data.context = $('#startupload').text('Importing');
-                            data.submit();
-                            // unregister click event to allow different subsequent uploads
-                            $('#startupload').off('click');
-                        });
+
+                    // Bind the upload data to the view, so it is
+                    // available to the click handler, and enable the
+                    // upload button.
+                    view.fileUploadData = data;
+                    data.context = view.uploadButton.removeProp('disabled');
                 },
                 done: function (e, data) {
                     /*jslint unparam:true*/
@@ -77,6 +78,18 @@
             return false;
         },
 
+        handleUploadClick: function (ev) {
+            ev.preventDefault();
+
+            if (!this.uploadButton.prop('disabled')) {
+                this.fileUploadData.context = this.uploadButton.text('Importing');
+                this.fileUploadData.submit();
+            }
+
+            // Prevent double post by disabling the button.
+            this.uploadButton.prop('disabled', 'disabled');
+        },
+
         handleDeleteClick: function (ev) {
             ev.preventDefault();
             this.addSubview(new Ghost.Views.Modal({
@@ -141,4 +154,4 @@
             }));
         }
     });
-}());
\ No newline at end of file
+}());

From fa98a1ed18ee829858d73b884c9b75d949805306 Mon Sep 17 00:00:00 2001
From: Paul Adam Davis <pauladamdavis@gmail.com>
Date: Sun, 26 Jan 2014 17:04:13 +0000
Subject: [PATCH 06/10] Move styling from some elements from IDs to classes

Closes #1605

* Move styling for `#signup`, `#forgotten`, `#reset`, `#login`, `#usermenu` and `#notifications` to classes

No IDs have been added or removed, so any events shouldn't be affected and it passes all tests.
---
 core/client/assets/sass/layouts/auth.scss   | 6 +++---
 core/client/assets/sass/layouts/editor.scss | 4 ++--
 core/client/assets/sass/modules/global.scss | 6 +++---
 core/client/tpl/forgotten.hbs               | 2 +-
 core/client/tpl/login.hbs                   | 2 +-
 core/client/tpl/reset.hbs                   | 2 +-
 core/client/tpl/signup.hbs                  | 2 +-
 core/server/views/default.hbs               | 2 +-
 core/server/views/partials/navbar.hbs       | 2 +-
 9 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/core/client/assets/sass/layouts/auth.scss b/core/client/assets/sass/layouts/auth.scss
index 44c9ea300e..05d43b8000 100644
--- a/core/client/assets/sass/layouts/auth.scss
+++ b/core/client/assets/sass/layouts/auth.scss
@@ -55,7 +55,7 @@
    1. Login
    ============================================================================= */
 
-#login {
+.login-form {
     @include box-sizing(border-box);
     max-width: 530px;
     color: lighten($midgrey, 15%);
@@ -182,7 +182,7 @@
    2. Signup and Reset
    ============================================================================= */
 
-#signup, #reset {
+.signup-form, .reset-form {
     @include box-sizing(border-box);
     max-width: 280px;
     color: lighten($midgrey, 15%);
@@ -270,7 +270,7 @@
    3. Forgotten
    ============================================================================= */
 
-#forgotten {
+.forgotten-form {
     @include box-sizing(border-box);
     max-width: 280px;
     color: lighten($midgrey, 15%);
diff --git a/core/client/assets/sass/layouts/editor.scss b/core/client/assets/sass/layouts/editor.scss
index a22cad9fe8..9b1984acc0 100644
--- a/core/client/assets/sass/layouts/editor.scss
+++ b/core/client/assets/sass/layouts/editor.scss
@@ -18,7 +18,7 @@
 
 .editor {
 
-    #notifications {
+    .notifications {
         @include breakpoint($biggerthan-mobile) {
             bottom: 40px;
         }
@@ -376,7 +376,7 @@
 
 body.zen {
     background: lighten($lightbrown, 3%);
-    #usermenu {display: none;}
+    .usermenu {display: none;}
     #global-header, #publish-bar {
         opacity: 0;
         height: 0;
diff --git a/core/client/assets/sass/modules/global.scss b/core/client/assets/sass/modules/global.scss
index ac5a8f4f84..fa058f3788 100644
--- a/core/client/assets/sass/modules/global.scss
+++ b/core/client/assets/sass/modules/global.scss
@@ -540,7 +540,7 @@ nav {
 }//.navbar
 
 // The user menu in the top right corner of the screen
-#usermenu {
+.usermenu.subnav {
     position:absolute;
     top:0;
     right:0;
@@ -636,7 +636,7 @@ nav {
 
         }
 
-        #usermenu {
+        .usermenu {
             position:fixed;
             top:0;
             right:auto;
@@ -928,7 +928,7 @@ nav {
    Notifications
    ========================================================================== */
 
-#notifications {
+.notifications {
     @include breakpoint($biggerthan-mobile) {
         position: absolute;
         bottom: 0;
diff --git a/core/client/tpl/forgotten.hbs b/core/client/tpl/forgotten.hbs
index 27f226c6bc..64f1508199 100644
--- a/core/client/tpl/forgotten.hbs
+++ b/core/client/tpl/forgotten.hbs
@@ -1,4 +1,4 @@
-<form id="forgotten" method="post" novalidate="novalidate">
+<form id="forgotten" class="forgotten-form" method="post" novalidate="novalidate">
     <div class="email-wrap">
         <input class="email" type="email" placeholder="Email Address" name="email" autocapitalize="off" autocorrect="off">
     </div>
diff --git a/core/client/tpl/login.hbs b/core/client/tpl/login.hbs
index 18b97e9fe5..a94df44728 100644
--- a/core/client/tpl/login.hbs
+++ b/core/client/tpl/login.hbs
@@ -1,4 +1,4 @@
-<form id="login" method="post" novalidate="novalidate">
+<form id="login" class="login-form" method="post" novalidate="novalidate">
     <div class="email-wrap">
         <input class="email" type="email" placeholder="Email Address" name="email" autocapitalize="off" autocorrect="off">
     </div>
diff --git a/core/client/tpl/reset.hbs b/core/client/tpl/reset.hbs
index 1204617c24..242426b4c6 100644
--- a/core/client/tpl/reset.hbs
+++ b/core/client/tpl/reset.hbs
@@ -1,4 +1,4 @@
-<form id="reset" method="post" novalidate="novalidate">
+<form id="reset" class="reset-form" method="post" novalidate="novalidate">
     <div class="password-wrap">
         <input class="password" type="password" placeholder="Password" name="newpassword" />
     </div>
diff --git a/core/client/tpl/signup.hbs b/core/client/tpl/signup.hbs
index 67f84a61d4..2543c663bf 100644
--- a/core/client/tpl/signup.hbs
+++ b/core/client/tpl/signup.hbs
@@ -1,4 +1,4 @@
-<form id="signup" method="post" novalidate="novalidate">
+<form id="signup" class="signup-form" method="post" novalidate="novalidate">
     <div class="name-wrap">
         <input class="name" type="text" placeholder="Full Name" name="name" autocorrect="off" />
     </div>
diff --git a/core/server/views/default.hbs b/core/server/views/default.hbs
index 039387b6af..661c90389a 100644
--- a/core/server/views/default.hbs
+++ b/core/server/views/default.hbs
@@ -39,7 +39,7 @@
     <main role="main" id="main">
         {{updateNotification}}
 
-        <aside id="notifications">
+        <aside id="notifications" class="notifications">
             {{> notifications}}
         </aside>
 
diff --git a/core/server/views/partials/navbar.hbs b/core/server/views/partials/navbar.hbs
index ee0e26bad9..e4d1a7dbb3 100644
--- a/core/server/views/partials/navbar.hbs
+++ b/core/server/views/partials/navbar.hbs
@@ -8,7 +8,7 @@
                 <li class="{{navClass}}{{#if selected}} active{{/if}}"><a href="{{adminUrl}}{{path}}">{{name}}</a></li>
             {{/each}}
 
-            <li id="usermenu" class="subnav">
+            <li id="usermenu" class="usermenu subnav">
                 <a href="#" data-toggle="ul" class="dropdown">
                     <img class="avatar" src="{{#if currentUser.image}}{{currentUser.image}}{{else}}{{asset "shared/img/user-image.png"}}{{/if}}" alt="Avatar" />
                     <span class="name">{{#if currentUser.name}}{{currentUser.name}}{{else}}{{currentUser.email}}{{/if}}</span>

From 1df6ac3b9435341de23e8f01e750de5f1e72933e Mon Sep 17 00:00:00 2001
From: Lev Gimelfarb <lev.gimelfarb@gmail.com>
Date: Sun, 26 Jan 2014 17:00:50 -0500
Subject: [PATCH 07/10] Detect SSL connection whether or not behind a proxy

closes #1836
- adding server.enable('trust proxy') to let connect framework do the work
  of detecting X-Forwarded-Proto header
- replacing explicit checking for the X-Forwarded-Proto header with just
  'req.secure' boolean check
---
 core/server/middleware/index.js | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/core/server/middleware/index.js b/core/server/middleware/index.js
index 53470c4724..10078d91f0 100644
--- a/core/server/middleware/index.js
+++ b/core/server/middleware/index.js
@@ -183,11 +183,7 @@ function isSSLrequired(isAdmin) {
 // and redirect if needed
 function checkSSL(req, res, next) {
     if (isSSLrequired(res.isAdmin)) {
-        // Check if X-Forarded-Proto headers are sent, if they are check for https.
-        // If they are not assume true to avoid infinite redirect loop.
-        // If the X-Forwarded-Proto header is missing and Express cannot automatically sense HTTPS the redirect will not be made.
-        var httpsHeader = req.header('X-Forwarded-Proto') !== undefined ? req.header('X-Forwarded-Proto').toLowerCase() === 'https' ? true : false : true;
-        if (!req.secure && !httpsHeader) {
+        if (!req.secure) {
             return res.redirect(301, url.format({
                 protocol: 'https:',
                 hostname: url.parse(config().url).hostname,
@@ -208,6 +204,10 @@ module.exports = function (server, dbHash) {
     expressServer = server;
     middleware.cacheServer(expressServer);
 
+    // Make sure 'req.secure' is valid for proxied requests
+    // (X-Forwarded-Proto header will be checked, if present)
+    expressServer.enable('trust proxy');
+
     // Logging configuration
     if (expressServer.get('env') !== 'development') {
         expressServer.use(express.logger());

From 6cf586aae654f5f1c696b95672d3e66cdfde0589 Mon Sep 17 00:00:00 2001
From: Lev Gimelfarb <lev.gimelfarb@gmail.com>
Date: Sun, 26 Jan 2014 17:21:24 -0500
Subject: [PATCH 08/10] Fix error page resources loading when forceAdminSSL is
 true

closes #1837
- moved admin theme static resource service above 'checkSSL', otherwise
  when forceAdminSSL is true it will try to redirect them to HTTPS, and
  error pages will be unstyled
---
 core/server/middleware/index.js | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/core/server/middleware/index.js b/core/server/middleware/index.js
index 10078d91f0..03705b7197 100644
--- a/core/server/middleware/index.js
+++ b/core/server/middleware/index.js
@@ -227,13 +227,16 @@ module.exports = function (server, dbHash) {
     // First determine whether we're serving admin or theme content
     expressServer.use(manageAdminAndTheme);
 
-    // Force SSL
-    expressServer.use(checkSSL);
-
 
     // Admin only config
     expressServer.use(subdir + '/ghost', middleware.whenEnabled('admin', express['static'](path.join(corePath, '/client/assets'), {maxAge: ONE_YEAR_MS})));
 
+    // Force SSL
+    // NOTE: Importantly this is _after_ the check above for admin-theme static resources,
+    //       which do not need HTTPS. In fact, if HTTPS is forced on them, then 404 page might
+    //       not display properly when HTTPS is not available!
+    expressServer.use(checkSSL);
+
     // Theme only config
     expressServer.use(subdir, middleware.whenEnabled(expressServer.get('activeTheme'), middleware.staticTheme()));
 

From cf805181e678dc3808a1b66682d90a5db3324a4b Mon Sep 17 00:00:00 2001
From: John O'Nolan <john@tryghost.org>
Date: Tue, 28 Jan 2014 14:11:35 +0700
Subject: [PATCH 09/10] Hide extra space taken up by update notification

See #1995
---
 core/client/assets/sass/modules/global.scss | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/core/client/assets/sass/modules/global.scss b/core/client/assets/sass/modules/global.scss
index fa058f3788..0db58341f4 100644
--- a/core/client/assets/sass/modules/global.scss
+++ b/core/client/assets/sass/modules/global.scss
@@ -1028,6 +1028,12 @@ nav {
     background: $blue;
 }
 
+// Hide extra space taken up by update notification
+.update-available main {
+    bottom: 56px;
+}
+
+
 /* ==========================================================================
    Modals
    ========================================================================== */

From 1afeeaf2d423dd401bed120e04edac952eb81159 Mon Sep 17 00:00:00 2001
From: Hannah Wolfe <erisds@gmail.com>
Date: Tue, 28 Jan 2014 09:20:39 +0000
Subject: [PATCH 10/10] Version bump for rc1

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index c2507822f1..6d4b8988dd 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
     "name"        : "ghost",
-    "version"     : "0.4.0",
+    "version"     : "0.4.1-rc1",
     "description" : "Just a blogging platform.",
     "author"      : "Ghost Foundation",
     "homepage"    : "http://ghost.org",