Index: wp-includes/script-loader.php
===================================================================
--- wp-includes/script-loader.php	(revision 20355)
+++ wp-includes/script-loader.php	(working copy)
@@ -417,6 +417,7 @@
 		) );
 
 		$scripts->add( 'custom-background', "/wp-admin/js/custom-background$suffix.js", array('farbtastic'), false, 1 );
+		$scripts->add( 'media-gallery', "/wp-admin/js/media-gallery$suffix.js", array('jquery'), false, 1 );
 	}
 }
 
Index: wp-admin/includes/media.php
===================================================================
--- wp-admin/includes/media.php	(revision 20355)
+++ wp-admin/includes/media.php	(working copy)
@@ -403,18 +403,20 @@
 	return "<a href='" . esc_url( get_upload_iframe_src($type) ) . "' id='{$id}-add_{$type}' class='thickbox add_$type' title='" . esc_attr( $title ) . "'><img src='" . esc_url( admin_url( $icon ) ) . "' alt='$title' onclick='return false;' /></a>";
 }
 
-function get_upload_iframe_src( $type = null, $post_id = null ) {
+function get_upload_iframe_src( $type = null, $post_id = null, $tab = null ) {
 	global $post_ID;
 
 	if ( empty( $post_id ) )
 		$post_id = $post_ID;
 
-	$uploading_iframe_ID = (int) $post_id;
-	$upload_iframe_src = add_query_arg( 'post_id', $uploading_iframe_ID, admin_url('media-upload.php') );
+	$upload_iframe_src = add_query_arg( 'post_id', (int) $post_id, admin_url('media-upload.php') );
 
 	if ( $type && 'media' != $type )
 		$upload_iframe_src = add_query_arg('type', $type, $upload_iframe_src);
 
+	if ( ! empty( $tab ) )
+		$upload_iframe_src = add_query_arg('tab', $tab, $upload_iframe_src);
+
 	$upload_iframe_src = apply_filters($type . '_upload_iframe_src', $upload_iframe_src);
 
 	return add_query_arg('TB_iframe', true, $upload_iframe_src);
@@ -497,7 +499,7 @@
 	if ( isset($send_id) ) {
 		$attachment = stripslashes_deep( $_POST['attachments'][$send_id] );
 
-		$html = $attachment['post_title'];
+		$html = isset( $attachment['post_title'] ) ? $attachment['post_title'] : '';
 		if ( !empty($attachment['url']) ) {
 			$rel = '';
 			if ( strpos($attachment['url'], 'attachment_id') || get_attachment_link($send_id) == $attachment['url'] )
Index: wp-admin/js/media-gallery.dev.js
===================================================================
--- wp-admin/js/media-gallery.dev.js	(revision 0)
+++ wp-admin/js/media-gallery.dev.js	(revision 0)
@@ -0,0 +1,25 @@
+jQuery(function($){
+	$( 'body' ).bind( 'click.wp-gallery', function(e){
+		var target = $( e.target ), id, img_size;
+
+		if ( target.hasClass( 'wp-set-header' ) ) {
+			( window.dialogArguments || opener || parent || top ).location.href = target.data( 'location' );
+			e.preventDefault();
+		} else if ( target.hasClass( 'wp-set-background' ) ) {
+			id = target.data( 'attachment-id' );
+			img_size = $( 'input[name="attachments[' + id + '][image-size]"]:checked').val();
+
+			jQuery.post(ajaxurl, {
+				action: 'set-background-image',
+				attachment_id: id,
+				size: img_size
+			}, function(){
+				var win = window.dialogArguments || opener || parent || top;
+				win.tb_remove();
+				win.location.reload();
+			});
+
+			e.preventDefault();
+		}
+	});
+});
Index: wp-admin/custom-header.php
===================================================================
--- wp-admin/custom-header.php	(revision 20355)
+++ wp-admin/custom-header.php	(working copy)
@@ -92,6 +92,9 @@
 		add_action("admin_head-$page", array(&$this, 'take_action'), 50);
 		add_action("admin_head-$page", array(&$this, 'js'), 50);
 		add_action("admin_head-$page", $this->admin_header_callback, 51);
+
+		add_filter( 'attachment_fields_to_edit', array( $this, 'attachment_fields_to_edit' ), 10, 2 );
+		add_filter( 'media_upload_tabs', array( $this, 'filter_upload_tabs' ) );
 	}
 
 	/**
@@ -128,8 +131,11 @@
 			return 1;
 
 		$step = (int) $_GET['step'];
-		if ( $step < 1 || 3 < $step )
-			$step = 1;
+		if ( $step < 1 || 3 < $step ||
+			( 2 == $step && ! wp_verify_nonce( $_REQUEST['_wpnonce-custom-header-upload'], 'custom-header-upload' ) ) ||
+			( 3 == $step && ! wp_verify_nonce( $_REQUEST['_wpnonce'], 'custom-header-crop-image' ) )
+		)
+			return 1;
 
 		return $step;
 	}
@@ -142,10 +148,15 @@
 	function js_includes() {
 		$step = $this->step();
 
-		if ( ( 1 == $step || 3 == $step ) && current_theme_supports( 'custom-header', 'header-text' ) )
-			wp_enqueue_script('farbtastic');
-		elseif ( 2 == $step )
+		if ( ( 1 == $step || 3 == $step ) ) {
+			add_thickbox();
+			wp_enqueue_script( 'media-upload' );
+			wp_enqueue_script( 'custom-header' );
+			if ( current_theme_supports( 'custom-header', 'header-text' ) )
+				wp_enqueue_script('farbtastic');
+		} elseif ( 2 == $step ) {
 			wp_enqueue_script('imgareaselect');
+		}
 	}
 
 	/**
@@ -395,7 +406,7 @@
 		<?php if ( display_header_text() ) { ?>
 		pickColor('#<?php echo get_header_textcolor(); ?>');
 		<?php } else { ?>
-		toggle_text();		
+		toggle_text();
 		<?php } ?>
 	});
 })(jQuery);
@@ -553,6 +564,12 @@
 		<?php submit_button( __( 'Upload' ), 'button', 'submit', false ); ?>
 	</p>
 	</form>
+	<?php
+		$image_library_url = get_upload_iframe_src( 'image', null, 'library' );
+		$image_library_url = remove_query_arg( 'TB_iframe', $image_library_url );
+		$image_library_url = add_query_arg( array( 'context' => 'custom-header', 'TB_iframe' => 1 ), $image_library_url );
+	?>
+	<span class="howto"><?php _ex( 'or', 'Custom Header: Choose an image from your computer - or - Choose from image library' ); ?></span> <a class="thickbox" href="<?php echo $image_library_url; ?>"><?php _e( 'Choose from image library' ); ?></a>
 </td>
 </tr>
 <?php endif; ?>
@@ -674,29 +691,15 @@
 		if ( ! current_theme_supports( 'custom-header', 'uploads' ) )
 			wp_die( __( 'Cheatin&#8217; uh?' ) );
 
-		$overrides = array('test_form' => false);
-		$file = wp_handle_upload($_FILES['import'], $overrides);
+		if ( empty( $_POST ) && isset( $_GET['file'] ) ) {
+			$id = absint( $_GET['file'] );
+			$file = get_attached_file( $id, true );
+			$url = wp_get_attachment_image_src( $id, 'full');
+			$url = $url[0];
+		} elseif ( isset( $_POST ) ) {
+			extract($this->step_2_manage_upload());
+		}
 
-		if ( isset($file['error']) )
-			wp_die( $file['error'],  __( 'Image Upload Error' ) );
-
-		$url = $file['url'];
-		$type = $file['type'];
-		$file = $file['file'];
-		$filename = basename($file);
-
-		// Construct the object array
-		$object = array(
-		'post_title' => $filename,
-		'post_content' => $url,
-		'post_mime_type' => $type,
-		'guid' => $url,
-		'context' => 'custom-header'
-		);
-
-		// Save the data
-		$id = wp_insert_attachment($object, $file);
-
 		list($width, $height, $type, $attr) = getimagesize( $file );
 
 		$max_width = 0;
@@ -753,6 +756,9 @@
 	<input type="hidden" name="height" id="height" value="<?php echo esc_attr( $height ); ?>"/>
 	<input type="hidden" name="attachment_id" id="attachment_id" value="<?php echo esc_attr( $id ); ?>" />
 	<input type="hidden" name="oitar" id="oitar" value="<?php echo esc_attr( $oitar ); ?>" />
+	<?php if ( empty( $_POST ) && isset( $_GET['file'] ) ) { ?>
+	<input type="hidden" name="new-attachment" value="true" />
+	<?php } ?>
 	<?php wp_nonce_field( 'custom-header-crop-image' ) ?>
 
 	<?php submit_button( __( 'Crop and Publish' ) ); ?>
@@ -762,6 +768,33 @@
 		<?php
 	}
 
+
+	function step_2_manage_upload() {
+		$overrides = array('test_form' => false);
+		$file = wp_handle_upload($_FILES['import'], $overrides);
+
+		if ( isset($file['error']) )
+			wp_die( $file['error'],  __( 'Image Upload Error' ) );
+
+		$url = $file['url'];
+		$type = $file['type'];
+		$file = $file['file'];
+		$filename = basename($file);
+
+		// Construct the object array
+		$object = array(
+			'post_title'     => $filename,
+			'post_content'   => $url,
+			'post_mime_type' => $type,
+			'guid'           => $url,
+			'context'        => 'custom-header'
+		);
+
+		// Save the data
+		$id = wp_insert_attachment( $object, $file );
+		return compact( 'id', 'file', 'filename', 'url', 'type' );
+	}
+
 	/**
 	 * Display third step of custom header image page.
 	 *
@@ -826,9 +859,11 @@
 			'guid' => $url,
 			'context' => 'custom-header'
 		);
+		if ( isset( $_POST['new-attachment'] ) && $_POST['new-attachment'] )
+			unset($object['ID']);
 
 		// Update the attachment
-		wp_insert_attachment($object, $cropped);
+		$attachment_id = wp_insert_attachment( $object, $cropped );
 		wp_update_attachment_metadata( $attachment_id, wp_generate_attachment_metadata( $attachment_id, $cropped ) );
 		update_post_meta( $attachment_id, '_wp_attachment_is_custom_header', get_option('stylesheet' ) );
 
@@ -845,8 +880,10 @@
 
 		// cleanup
 		$medium = str_replace(basename($original), 'midsize-'.basename($original), $original);
-		@unlink( apply_filters( 'wp_delete_file', $medium ) );
-		@unlink( apply_filters( 'wp_delete_file', $original ) );
+		if ( file_exists( $medium ) )
+			@unlink( apply_filters( 'wp_delete_file', $medium ) );
+		if ( empty ( $_POST['new-attachment'] ) )
+			@unlink( apply_filters( 'wp_delete_file', $original ) );
 
 		return $this->finished();
 	}
@@ -870,12 +907,36 @@
 		if ( ! current_user_can('edit_theme_options') )
 			wp_die(__('You do not have permission to customize headers.'));
 		$step = $this->step();
-		if ( 1 == $step || ! $_POST )
-			$this->step_1();
-		elseif ( 2 == $step )
+		if ( 2 == $step )
 			$this->step_2();
 		elseif ( 3 == $step )
 			$this->step_3();
+		else
+			$this->step_1();
 	}
 
+	function attachment_fields_to_edit( $form_fields, $post ) {
+		if ( isset( $_REQUEST['context'] ) && $_REQUEST['context'] == 'custom-header' ) {
+			$form_fields = array();
+			$href = esc_url(add_query_arg(array(
+				'page' => 'custom-header',
+				'step' => 2,
+				'_wpnonce-custom-header-upload' => wp_create_nonce('custom-header-upload'),
+				'file' => $post->ID
+			), admin_url('themes.php')));
+
+			$form_fields['buttons'] = array( 'tr' => '<tr class="submit"><td></td><td><a data-location="' . $href . '" class="wp-set-header">' . _( 'Set as header' ) . '</a></td></tr>' );
+			$form_fields['context'] = array( 'input' => 'hidden', 'value' => 'custom-header' );
+		}
+
+		return $form_fields;
+	}
+
+	function filter_upload_tabs( $tabs ) {
+		if ( isset( $_REQUEST['context'] ) && $_REQUEST['context'] == 'custom-header' )
+			return array( 'library' => __('Media Library') );
+
+		return $tabs;
+	}
+
 }
Index: wp-admin/media-upload.php
===================================================================
--- wp-admin/media-upload.php	(revision 20355)
+++ wp-admin/media-upload.php	(working copy)
@@ -22,6 +22,7 @@
 wp_enqueue_script('image-edit');
 wp_enqueue_script('set-post-thumbnail' );
 wp_enqueue_style('imgareaselect');
+wp_enqueue_script( 'media-gallery' );
 
 @header('Content-Type: ' . get_option('html_type') . '; charset=' . get_option('blog_charset'));
 
Index: wp-admin/custom-background.php
===================================================================
--- wp-admin/custom-background.php	(revision 20355)
+++ wp-admin/custom-background.php	(working copy)
@@ -55,6 +55,7 @@
 		$this->admin_image_div_callback = $admin_image_div_callback;
 
 		add_action( 'admin_menu', array( $this, 'init' ) );
+		add_action( 'wp_ajax_set-background-image', array( $this, 'wp_set_background_image' ) );
 	}
 
 	/**
@@ -71,6 +72,8 @@
 		add_action("load-$page", array(&$this, 'admin_load'));
 		add_action("load-$page", array(&$this, 'take_action'), 49);
 		add_action("load-$page", array(&$this, 'handle_upload'), 49);
+		add_filter( 'attachment_fields_to_edit', array( $this, 'attachment_fields_to_edit' ), 10, 2 );
+		add_filter( 'media_upload_tabs', array( $this, 'filter_upload_tabs' ) );
 
 		if ( $this->admin_header_callback )
 			add_action("admin_head-$page", $this->admin_header_callback, 51);
@@ -98,6 +101,8 @@
 			'<p>' . __( '<a href="http://wordpress.org/support/" target="_blank">Support Forums</a>' ) . '</p>'
 		);
 
+		add_thickbox();
+		wp_enqueue_script('media-upload');
 		wp_enqueue_script('custom-background');
 		wp_enqueue_style('farbtastic');
 	}
@@ -126,6 +131,7 @@
 			set_theme_mod('background_image', '');
 			set_theme_mod('background_image_thumb', '');
 			$this->updated = true;
+			wp_safe_redirect( $_POST['_wp_http_referer'] );
 			return;
 		}
 
@@ -248,7 +254,13 @@
 <input type="hidden" name="action" value="save" />
 <?php wp_nonce_field('custom-background-upload', '_wpnonce-custom-background-upload') ?>
 <?php submit_button( __( 'Upload' ), 'button', 'submit', false ); ?>
-</form>
+<?php
+	$image_library_url = get_upload_iframe_src( 'image', null, 'library' );
+	$image_library_url = remove_query_arg( 'TB_iframe', $image_library_url );
+	$image_library_url = add_query_arg( array( 'context' => 'custom-background', 'TB_iframe' => 1 ), $image_library_url );
+?>
+	</form>
+	<span class="howto"><?php _ex( 'or', 'Custom Background: Choose an image from your computer - or - Choose from image library' ); ?></span> <a class="thickbox" href="<?php echo $image_library_url; ?>"><?php _e( 'Choose from image library' ); ?></a>
 </td>
 </tr>
 </tbody>
@@ -368,4 +380,36 @@
 		$this->updated = true;
 	}
 
+	function attachment_fields_to_edit( $form_fields, $post ) {
+		if ( isset( $_REQUEST['context'] ) && $_REQUEST['context'] == 'custom-background' ) {
+			$form_fields = array( 'image-size' => $form_fields['image-size'] );
+			$form_fields['buttons'] = array( 'tr' => '<tr class="submit"><td></td><td><a data-attachment-id="' . $post->ID . '" class="wp-set-background">' . _( 'Set as background' ) . '</a></td></tr>' );
+			$form_fields['context'] = array( 'input' => 'hidden', 'value' => 'custom-background' );
+		}
+
+		return $form_fields;
+	}
+
+	function filter_upload_tabs ( $tabs ){
+		if ( isset( $_REQUEST['context'] ) && $_REQUEST['context'] == 'custom-background' )
+			return array( 'library' => __('Media Library') );
+
+		return $tabs;
+	}
+
+	public function wp_set_background_image() {
+		if ( ! current_user_can('edit_theme_options') || ! isset( $_POST['attachment_id'] ) ) exit;
+		$attachment_id = absint($_POST['attachment_id']);
+		$sizes = array_keys(apply_filters( 'image_size_names_choose', array('thumbnail' => __('Thumbnail'), 'medium' => __('Medium'), 'large' => __('Large'), 'full' => __('Full Size')) ));
+		$size = 'thumbnail';
+		if ( in_array( $_POST['size'], $sizes ) )
+			$size = esc_attr( $_POST['size'] );
+
+		update_post_meta( $attachment_id, '_wp_attachment_is_custom_background', get_option('stylesheet' ) );
+		$url = wp_get_attachment_image_src( $attachment_id, $size );
+		$thumbnail = wp_get_attachment_image_src( $attachment_id, 'thumbnail' );
+		set_theme_mod( 'background_image', esc_url( $url[0] ) );
+		set_theme_mod( 'background_image_thumb', esc_url( $thumbnail[0] ) );
+		exit;
+	}
 }