rails: devise update user without password

Question

I've followed the directions in devise's wiki regarding overriding update method to update user information without adding password, but I'm still getting notice saying that I can't leave password blank. I'm stuck and I need some assistance on tracking the problem down.

<%= form_for(resource, :as => resource_name, :url => custom_update_user_registration_path, :html => { :method => :put }) do |f| %>
  <%= devise_error_messages! %>
    <%= f.text_field :first_name %>
    <%= f.text_field :last_name %>
    <%= f.email_field :email, :autofocus => true %>
  <% if devise_mapping.confirmable? && resource.pending_reconfirmation? %>
    <div>Currently waiting confirmation for: <%= resource.unconfirmed_email %></div>
  <% end %>
<%= f.submit "Update" %>

in my routes :

  devise_for :user, :controllers => { :registrations => "registrations" }, :skip => [:registrations, :sessions] do 

    get 'signup' => 'devise/registrations#new', :as => :new_user_registration 
    post 'signup' => 'devise/registrations#create', :as => :custom_user_registration 
    get 'users/cancel' => 'devise/registrations#cancel', :as => :cancel_user_registration 
    get 'account/edit' => 'devise/registrations#edit', :as => :custom_edit_user_registration 
    put 'account' => 'devise/registrations#update', :as => :custom_update_user_registration
    delete 'users/cancel' => 'devise/registrations#destroy'   
    # devise/sessions 
    get 'signin' => 'devise/sessions#new', :as => :new_user_session 
    post 'signin' => 'devise/sessions#create', :as => :user_session 
    delete 'signout' => 'devise/sessions#destroy', :as => :destroy_user_session

  end

Here's my controller:

class RegistrationsController < Devise::RegistrationsController
  before_filter :check_permissions, :only => [:new, :create, :cancel]
  skip_before_filter :require_no_authentication

  def check_permissions
    authorize! :create, resource
  end

  def update
    @user.attributes = params[:user]  
    # required for settings form to submit when password is left blank
    if params[:user][:password].blank? && params[:user][:password_confirmation].blank?
        params[:user].delete(:password)
        params[:user].delete(:password_confirmation)
    end

    @user = User.find(current_user.id)
    if @user.update_attributes(params[:user])
      set_flash_message :notice, :updated
      # Sign in the user bypassing validation in case his password changed
      sign_in @user, :bypass => true
      redirect_to after_update_path_for(@user)
    else
      render "edit"
    end

  end
end

I'm not sure why I'm getting the error that I need to submit password still? Can someone see something that I'm overlooking?

Thanks

Answer 1

I just found out that I've been overriding my devise registration incorrectly.

This was the correct way of having registration controller

Rails 3 /devise seems to ignore custom controller

Answer 2

You could handle that in your model normally. Just edit your valdiations. This way you normally do not need to override the whole controller..just edit the model:

validates :password, :presence => true, :on => :create

Answer 3

Try to change

if @user.update_attributes(params[:user])

to device method

if @user.update_without_password(params[:user])

Answer 4

In class RegistrationsController < Devise::RegistrationsController you are missing update parameters for devise.

def configure_permitted_parameters
  devise_parameter_sanitizer.for(:account_update) { |u| u.permit(:email, :password, ...) }
end

def update
# Get all params for :account_update
account_update_params = devise_parameter_sanitizer.sanitize(:account_update)

# Allow user to update without using password.
if account_update_params[:password].blank?
  account_update_params.delete("password")
  account_update_params.delete("password_confirmation")
end

# Set current_user
@user = User.find(current_user.id)
 if @user.update_attributes(account_update_params)
   set_flash_message :notice, :updated
   sign_in @user, :bypass => true
   redirect_to after_update_path_for(@user)
 else
   render "edit"
 end
end