Updating Strong Params Only

Question

First of all, I believe there must be some people, who already asked this question before but I don't know how can I google this problem. So, if it is duplicate I am sorry.

I am working on a social media site. I have user model, which I use to register users to the site. It validates, name, email, and password when registering.

I use the same model to make users edit their informations, like username.

This is what I have in my update controller:

  def update
    # Find an existing object using form parameters
    @profile = User.find_by_id(current_user.id)
    # Update the object
    if @profile.update_attributes!(settings_profile_params)
      # If save succeeds, redirect to itself
      redirect_to request.referrer
    else
      # If save fails, redisplay the form so user can fix the problems
      render('edit')
    end
  end

  private # user_params is not an action, that is why it is private.
  def settings_profile_params
    params.require(:user).permit(:first_name, :last_name, :username, :school, :program, :website, :information)
  end

The problem is, I only want to update strong parameters that I defined there. But I am getting an exception because of password validation. I don't know why am I getting this exception. How can I set up system to update the values in strong parameter only.

Thank you.

Answer 1

You can achieve this by changing you password validation. You need to add a condition on password validation.

# Password
  validates :password,
            :presence => {:message => 'Password cannot be blank'},
            :length => {:within => 8..99, :message => 'Password length should be within 8 and 99 characters'}
            :if => Proc.new { new_record? || !password.nil? }

Answer 2

By calling update_attributes you are implicitly invoking the same range of validations as an other update and save. You need to update on the specific params you're targeting (e.g. omitting :password).

Here, we can store that list of permitted keys in a variable that is reusable. Then we call update_attribute on each of those keys — doing so within a reduce that gives the same true/false for the switch to edit or display.

  def update
    # Find an existing object using form parameters
    @profile = User.find_by_id(current_user.id)
    # Update the object
    if PERMITTED_KEYS.reduce(true) {|bool, key| bool &&= @profile.update_attribute(key, @profile.send(key)) }
      # If save succeeds, redirect to itself
      redirect_to request.referrer
    else
      # If save fails, redisplay the form so user can fix the problems
      render('edit')
    end
  end

  private 

  PERMITTED_KEYS = [:first_name, :last_name, :username, :school, :program, :website, :information]

  # user_params is not an action, that is why it is private.
  def settings_profile_params
    params.require(:user).permit(PERMITTED_KEYS)
  end

Having not used strong_parameters gem before, I think this would be more idiomatic to the use of the gem:

  def update
    # Find an existing object using form parameters
    @profile = User.find_by_id(current_user.id)
    # Update the object
    if settings_profile_params.keys.reduce(true) {|bool, key| bool &&= @profile.update_attribute(key, @profile.send(key)) }
      # If save succeeds, redirect to itself
      redirect_to request.referrer
    else
      # If save fails, redisplay the form so user can fix the problems
      render('edit')
    end
  end

  private 

  # user_params is not an action, that is why it is private.
  def settings_profile_params
    params.require(:user).permit(
      :first_name, :last_name, :username, 
      :school, :program, 
      :website, :information
    )
  end

---

Though, I still think this is a duplicate question, since it regard how to update model data without all of the defined validation. I've answered in case the update_attributes loop is felt to be a sufficiently unique solution to warrant non-duplication.

Answer 3

Okay, now I found the problem. First of all, @Muntasim figured out a way to solve this problem. But I actually don't need to use this solution, because there is another easy way to fix this.

In this situation, when I let users to update their profiles, rails should not validate my password or any other column in user model, if I don't ask it to. But why was it validating? Because I have validates :password in user model. Instead it has to be validates :digest_password. Because I am using bcrypt.

I don't know why :password was working fine when I register even though I used bcrypt.