Rails for Beginners Part 19: Edit Password Discussion
Editing the password with an empty string (i.e. not filling the fields and clicking right away on the submit button) doesn't throw any error, Current.user.update(password_params) returns true and the redirection is working. However, the password is not changed in the database. I don't get how it is possible that the update method returns true but at the same time, the database is not updated and there is not even a error message in the logs.
maybe you should authenticate the form using html and javascript or doing something like this
https://guides.rubyonrails.org/active_record_validations.html
I tried but not worked here for me, so, I should use some regex in html and javascript, but I think rails has a better way.
Yes, you can simply add this in your user model: "validates :password, presence: true". Thus, it's attaching an error "Password can't be blank" to your model's instance which is displayed on the edit view. What I don't understand is that, when you don't add this validation and submit an empty form, you do get redirected to the rootpah with the notice "password updated!", which means Current.user.update(password_params) is working. So I would expect the password to be changed to an empty string, but it is not the case. The password remains unchanged. I hope it makes sense, sorry, english is not my native language.
Ok, so answering to myself: this is a default implementation (discussed here: https://github.com/rails/rails/issues/34348). And the reason for this implementation is, I quote: "the reason the password is ignored for empty strings is that if a user has a form with multiple fields (including password) and they update details but don't enter the password, then we want to allow the other details to be updated without the password being effected.". Makes sense eventually :)
I'm having an issue where it does not validate the confirmation to the new password. So no matter if the two are different, it simply updates the password with whatever is in the password field.
Scratch that... no issue. My poor spelling was the problem. Only took 45 minutes to figure that out. :/
By the way, what's the reason that you've created a bang method called require_user_signed_in!. I know the general idea behind bang methods but how does that apply here? Why not just require_user_signed_in?
It's okay to put the if conditional at the end of the require_user_logged_in! method? Huh…