How to ensure only specific attributes are updated and force another attribute to be nil in Rails?

Question

In RailsCasts Episode #274 'Remember Me & Reset Password', the user enters their new password which submits to the PasswordResetsController.

The cast shows the line that updates the attributes to be:

elsif @user.update_attributes(params[:user])

for Rails 4, I've had to change this to:

elsif @user.update_attributes(params.permit![:user])

I only want the user's password attribute to be updated with what the user has entered, and also set the password_reset_token to nil. How can I do that and also ensure only those fields can be updated?

Answer 1

I think you want something like this:

elsif @user.update_attributes(
  params.require(:user).permit(:password, :password_confirmation).merge(password_reset_token: nil)
)