diff --git a/admin/file-upload-js.php b/admin/file-upload-js.php
index 5f92213b..a8881621 100644
--- a/admin/file-upload-js.php
+++ b/admin/file-upload-js.php
@@ -120,7 +120,7 @@ $(document).ready(function() {
     $('#tab-files').bind('init', function () {
         var uploader = new plupload.Uploader({
             browse_button   :   $('.upload-file').get(0),
-            url             :   '<?php $security->index('/action/upload'
+            url             :   '<?php $options->index('/action/upload'
                 . (isset($fileParentContent) ? '?cid=' . $fileParentContent->cid : '')); ?>',
             runtimes        :   'html5,flash,silverlight,html4',
             flash_swf_url   :   '<?php $options->adminUrl('js/Moxie.swf'); ?>',
diff --git a/admin/index.php b/admin/index.php
index facff7cb..1ee87fc2 100644
--- a/admin/index.php
+++ b/admin/index.php
@@ -10,9 +10,9 @@ $stat = Typecho_Widget::widget('Widget_Stat');
         <?php include 'page-title.php'; ?>
         <div class="row typecho-page-main">
             <div class="col-mb-12 welcome-board" role="main">
-                <p><?php _e('目前有 <em>%s</em> 篇日志, 并有 <em>%s</em> 条关于你的评论在 <em>%s</em> 个分类中.',
+                <p><?php _e('目前有 <em>%s</em> 篇文章, 并有 <em>%s</em> 条关于你的评论在 <em>%s</em> 个分类中.',
                 $stat->myPublishedPostsNum, $stat->myPublishedCommentsNum, $stat->categoriesNum); ?>
-                <br><?php _e('使用下面的链接开始你的故事吧:'); ?></p>
+                <br><?php _e('点击下面的链接快速开始:'); ?></p>
 
                 <ul id="start-link" class="clearfix">
                     <?php if($user->pass('contributor', true)): ?>
diff --git a/admin/media.php b/admin/media.php
index 8a315373..64cae0f1 100644
--- a/admin/media.php
+++ b/admin/media.php
@@ -144,7 +144,7 @@ $(document).ready(function() {
 
     var uploader = new plupload.Uploader({
         browse_button   :   $('.upload-file').get(0),
-        url             :   '<?php $security->index('/action/upload?do=modify&cid=' . $attachment->cid); ?>',
+        url             :   '<?php $options->index('/action/upload?do=modify&cid=' . $attachment->cid); ?>',
         runtimes        :   'html5,flash,silverlight,html4',
         flash_swf_url   :   '<?php $options->adminUrl('js/Moxie.swf'); ?>',
         silverlight_xap_url     :   '<?php $options->adminUrl('js/Moxie.xap'); ?>',
diff --git a/var/Widget/Metas/Category/Edit.php b/var/Widget/Metas/Category/Edit.php
index 13d79431..138deac5 100644
--- a/var/Widget/Metas/Category/Edit.php
+++ b/var/Widget/Metas/Category/Edit.php
@@ -223,7 +223,6 @@ class Widget_Metas_Category_Edit extends Widget_Abstract_Metas implements Widget
 
         /** 取出数据 */
         $category = $this->request->from('name', 'slug', 'description', 'parent');
-        $parent = 0;
 
         $category['slug'] = Typecho_Common::slugName(empty($category['slug']) ? $category['name'] : $category['slug']);
         $category['type'] = 'category';
@@ -259,13 +258,13 @@ class Widget_Metas_Category_Edit extends Widget_Abstract_Metas implements Widget
 
         /** 取出数据 */
         $category = $this->request->from('name', 'slug', 'description', 'parent');
-        $current = $this->fetchRow($this->select()->where('mid = ?', $category['mid']));
+        $current = $this->db->fetchRow($this->select()->where('mid = ?', $category['mid']));
         $category['slug'] = Typecho_Common::slugName(empty($category['slug']) ? $category['name'] : $category['slug']);
         $category['type'] = 'category';
         $category['mid'] = $this->request->mid;
 
         if ($current['parent'] != $category['parent']) {
-            $parent = $this->fetchRow($this->select()->where('mid = ?', $category['parent']));
+            $parent = $this->db->fetchRow($this->select()->where('mid = ?', $category['parent']));
 
             if ($parent['mid'] == $category['mid']) {
                 $category['order'] = $parent['order'];
@@ -307,7 +306,7 @@ class Widget_Metas_Category_Edit extends Widget_Abstract_Metas implements Widget
 
         if ($categories && is_array($categories)) {
             foreach ($categories as $category) {
-                $parent = $this->fetchObject($this->select()->where('mid = ?', $category))->parent;
+                $parent = $this->db->fetchObject($this->select()->where('mid = ?', $category))->parent;
 
                 if ($this->delete($this->db->sql()->where('mid = ?', $category))) {
                     $this->db->query($this->db->delete('table.relationships')->where('mid = ?', $category));
diff --git a/var/Widget/Security.php b/var/Widget/Security.php
index a51777ee..a064e945 100644
--- a/var/Widget/Security.php
+++ b/var/Widget/Security.php
@@ -32,7 +32,8 @@ class Widget_Security extends Typecho_Widget
         $token = uniqid();
         if ($user->hasLogin()) {
             $token = $user->authCode . '&' . $user->uid
-                . '&' . $this->request->getRequestUrl();
+                . '&' . $this->request->getRequestUrl()
+                . '&' . $this->request->getIp();
         }
 
         $this->_token = md5($token);
@@ -69,7 +70,8 @@ class Widget_Security extends Typecho_Widget
         $token = uniqid();
         if ($user->hasLogin()) {
             $token = $user->authCode . '&' . $user->uid
-                . '&' . $this->request->getReferer();
+                . '&' . $this->request->getReferer()
+                . '&' . $this->request->getIp();
         }
 
         if ($this->request->get('_') != md5($token)) {
diff --git a/var/Widget/Upload.php b/var/Widget/Upload.php
index e4b110f6..e22127e3 100644
--- a/var/Widget/Upload.php
+++ b/var/Widget/Upload.php
@@ -413,7 +413,6 @@ class Widget_Upload extends Widget_Abstract_Contents implements Widget_Interface
     public function action()
     {
         if ($this->user->pass('contributor', true) && $this->request->isPost()) {
-            $this->security->protect();
             if ($this->request->is('do=modify&cid')) {
                 $this->modify();
             } else {