changing password with authlogic - validation not catching blank inputs

Question

I am trying to create a form to allow users to change their password:

View:

- form_tag change_password_users_path do

  = error_messages_for :user, :header_message => "Please Try Again", :message => "We had some problems updating your account" 
  %br

  = label_tag :password, "New password:"
  = password_field_tag "password"
  %br

  = label_tag :password_confirmation, "NConfirm new password:"
  = password_field_tag "password_confirmation"
  %br

  = submit_tag "Update Account"

Controller:

def change_password
  @user = current_user
  if request.post?
    @user.password = params[:password]
    @user.password_confirmation = params[:password_confirmation]
    if @user.save
      redirect_to user_path(current_user)
    else
      render :action => "change_password"
    end        
  end
end

Authlogic is catching validation errors when the password is 'too short' or the password doesn't match the confirmation, but doesn't do anything when the form is submitted with both fields blank. @user.save must be returning true, because I am redirected to 'user_path(current_user)'.

The password is not actually changed in the database.

Thanks for your help.

Answer 1

Apparently this is the intended behavior.

http://www.ruby-forum.com/topic/198836

At least I know now...

Thanks.

Answer 2

I suggest you call @user.changed? like the following example to check for blank passwords:

def change_password
  @user = current_user
  if request.post?
    @user.password = params[:user][:password]
    @user.password_confirmation = params[:user][:password_confirmation]
    if @user.changed? && @user.save
      redirect_to user_path(current_user)
    else
      render :action => "change_password"
    end
  end
end

Answer 3

I want to do the folowwing in order to let the user change your password from a form (not by reset it by mail). Form Field Current Password New Password New Password confirmation

Update the user password only if: 1. current password is really the user password 2. new password = new password confirmation

Thanks