Merge pull request #4 from sebgie/sec/3

Sec/3

core/client/assets/sass/layouts/users.scss

@@ -206,8 +206,8 @@
 
         .img {
             display: block;
-            width: 100%;
-            height: 100%;
+            width: 110px;
+            height: 110px;
             background-image: url(/shared/img/user-image.png);
             background-size: cover;
             background-position: center center;
@@ -221,15 +221,14 @@
     }
 
     .edit-user-image {
-        position: absolute;
-        top: 0;
-        width: 100%;
-        height: 100%;
-        display: block;
+        @include position(absolute, 0px 0px 0px 0px);
         border-radius: 100%;
         background: rgba(0,0,0,0.5);
         opacity: 0;
         color: #fff;
+        line-height: 105px;
+        text-transform: uppercase;
+        text-decoration: none;
         @include transition(opacity 0.3s ease);
     }
 
@@ -257,4 +256,4 @@
         color: darken($brown, 5%);
     }
 
-} //.settings
+} //.settings

core/client/tpl/settings/user-profile.hbs

@@ -10,7 +10,7 @@
 
     <header class="user-profile-header">
         <img id="user-cover" class="cover-image" src="{{#if cover}}{{cover}}{{else}}/shared/img/user-cover.png{{/if}}" title="{{name}}'s Cover Image"/>
-        <button class="edit-cover-image js-modal-cover">Change Cover</button>
+        <a class="edit-cover-image js-modal-cover button" href="#">Change Cover</a>
     </header>
 
     <form class="user-profile" novalidate="novalidate">
@@ -18,8 +18,8 @@
         <fieldset class="user-details-top">
 
             <figure class="user-image">
-                <a id="user-image" class="img" {{#if image}}style="background-image: url({{image}});"{{/if}} href="#"><span class="hidden">{{name}}'s Picture</span></a>
-                <button class="edit-user-image js-modal-image">Edit Picture</button>
+                <div id="user-image" class="img" {{#if image}}style="background-image: url({{image}});"{{/if}} href="#"><span class="hidden">{{name}}'s Picture</span></div>
+                <a href="#" class="edit-user-image js-modal-image">Edit Picture</a>
             </figure>
 
             <div class="form-group">

core/server/api.js

@@ -19,7 +19,8 @@ var Ghost        = require('../ghost'),
     requestHandler,
     settingsObject,
     settingsCollection,
-    settingsFilter;
+    settingsFilter,
+    filteredUserAttributes = ['password', 'created_by', 'updated_by'];
 
 // ## Posts
 posts = {
@@ -28,7 +29,17 @@ posts = {
     // **takes:** filter / pagination parameters
     browse: function browse(options) {
         // **returns:** a promise for a page of posts in a json object
-        return dataProvider.Post.findPage(options);
+        //return dataProvider.Post.findPage(options);
+        return dataProvider.Post.findPage(options).then(function (result) {
+            var i = 0,
+                omitted = result;
+
+            for (i = 0; i < omitted.posts.length; i = i + 1) {
+                omitted.posts[i].author = _.omit(omitted.posts[i].author, filteredUserAttributes);
+                omitted.posts[i].user = _.omit(omitted.posts[i].user, filteredUserAttributes);
+            }
+            return omitted;
+        });
     },
 
     // #### Read
@@ -36,7 +47,13 @@ posts = {
     // **takes:** an identifier (id or slug?)
     read: function read(args) {
         // **returns:** a promise for a single post in a json object
-        return dataProvider.Post.findOne(args);
+
+        return dataProvider.Post.findOne(args).then(function (result) {
+            var omitted = result.toJSON();
+            omitted.author = _.omit(omitted.author, filteredUserAttributes);
+            omitted.user = _.omit(omitted.user, filteredUserAttributes);
+            return omitted;
+        });
     },
 
     // #### Edit
@@ -102,7 +119,16 @@ users = {
     // **takes:** options object
     browse: function browse(options) {
         // **returns:** a promise for a collection of users in a json object
-        return dataProvider.User.browse(options);
+
+        return dataProvider.User.browse(options).then(function (result) {
+            var i = 0,
+                omitted = result.toJSON();
+
+            for (i = 0; i < omitted.length; i = i + 1) {
+                omitted[i] = _.omit(omitted[i], filteredUserAttributes);
+            }
+            return omitted;
+        });
     },
 
     // #### Read
@@ -114,7 +140,10 @@ users = {
             args = {id: this.user};
         }
 
-        return dataProvider.User.read(args);
+        return dataProvider.User.read(args).then(function (result) {
+            var omitted = _.omit(result.toJSON(), filteredUserAttributes);
+            return omitted;
+        });
     },
 
     // #### Edit

core/server/controllers/frontend.js

@@ -88,7 +88,7 @@ frontendControllers = {
                 title: ghost.settings('title'),
                 description: ghost.settings('description'),
                 generator: 'Ghost v' + res.locals.version,
-                author: user ? user.attributes.name : null,
+                author: user ? user.name : null,
                 feed_url: url.resolve(siteUrl, '/rss/'),
                 site_url: siteUrl,
                 ttl: '60'