How to update user password using password_digest and form in Rails

user_3223075 0
Viewed 4807

I have the below files to update a users details. they currently work for everything except for the password. all of the logic is working correctly, I have used puts to check that the correct sections of logic are entered however it seems that the password never gets updated at the end when @user.update(user_params) is called.

To get this to work I have to add the 2 lines below into the password logic in UserController which doesn't seem logical given that I call @user.update(user_params) further on which should update the user with the user parameters provided. Any advice, suggestions or comments would be greatly appreciated.

@user.password = params[:user][:password]
@user.save

I'm not using any Gems etc for the authentication and my user table looks like the following

create_table "users", force: :cascade do |t|
    t.string "username"
    t.string "password_digest"
    t.datetime "created_at", precision: 6, null: false
    t.datetime "updated_at", precision: 6, null: false
    t.string "title"
    t.string "firstName"
    t.string "surname"
    t.index ["username"], name: "index_users_on_username", unique: true
end

UserController

class UsersController < ApplicationController

  skip_before_action :authorized, only: [:new, :create]
  before_action :set_user, only: [:update]
  def new
    @user = User.new
  end

  def create
    @user = User.create(params.require(:user).permit(:username, :password))
    session[:user_id] = @user.id
    redirect_to '/welcome'
  end

  def update
    errorMessage = ''
    if current_user.username != params[:user][:username]
      if User.find_by(username: params[:user][:username]).nil?
      else
        errorMessage += "Username is already taken"
      end
    else
    end
    if !params[:user][:password].blank?
      if @user.authenticate(params[:user][:password_confirmation])
      else
        errorMessage += "Confirmation password is incorrect"
      end
    else
    end

    if !errorMessage.blank?
      redirect_to account_path, notice: errorMessage
    else
      @user.update(user_params)
      redirect_to account_path
    end
  end

  private 
  def user_params
    params.require(:user).permit(:username, :title, :firstName, :surname,:password, :password_confirmation)
  end
  def set_user
    @user = current_user
  end
end

edit.html.erb

<p id=”notice”><%= notice %></p>
<%= form_for current_user do |f|%>
    <div class="form-group row col-md-12">
        <%= f.label :username, class:"col-sm-2 col-form-label"%><br>
        <%= f.text_field :username, class:"form-control col-sm-10" %>
    </div>

    <div class="form-group row col-md-12">
        <div class="col-md-2">
            <%= f.label :title%><br>
            <%= f.text_field :title, class:"form-control" %>
        </div>
        <div class="col-md-5">
            <%= f.label :firstName, "First Name" %><br>
            <%= f.text_field :firstName, class:"form-control" %>
        </div>
        <div class="col-md-5">
            <%= f.label :surname %><br>
            <%= f.text_field :surname, class:"form-control" %>
        </div>
    </div>

    <div class="form-group row col-md-12">
        <div class="col-md-6">
            <%= f.label :password_confirmation, "Current Password"%><br>
            <%= f.password_field :password_confirmation, class:"form-control" %>
        </div>
        <div class="col-md-6">
            <%= f.label :password, "New Password"%><br>
            <%= f.password_field :password, class:"form-control" %>
        </div>
        <small id="passwordHelpBlock" class="form-text text-muted col-md-12">
            To update your password, please confirm your current password.
        </small>
    </div>

    <%= f.submit "Submit" ,class: "btn btn-primary"%>
<% end %>

User Model

class User < ApplicationRecord
    has_secure_password
end
ruby-on-rails-6 bcrypt ruby-on-rails
2 Answers

Your controller is a bit complex, I assume that this is somehow causing your problem. You should output the errors in the view to see what's going wrong, this was unfortunately not part of your question.

Nevertheless, in general, there are two options to get this working described in the bcrypt ruby Github repository. Note, I have not tried with current_user, params[:user] and @user.authenticate to remove complexity and concentrate on the bcrypt topic.

Option 1

Using has_secure_password in your user model like this:

class User < ApplicationRecord
  has_secure_password
end

You need a password digest column and you need to work with :password in your user_params method.

def user_params
  params.require(:user).permit(:username, :title, :firstName, :surname, :password, :password_confirmation)
end

The entered password would be saved in the database in the password_digest column.

Option 2

This is described on the the-user-model part of the bcrypt Github page.

In this case, you do NOT use has_secure_password but add the following code to your user model:

class User < ApplicationRecord
  include BCrypt

  def password
    @password ||= Password.new(password_hash)
  end

  def password=(new_password)
    @password = Password.create(new_password)
    self.password_hash = @password
  end
end

Then your user_params method needs to reflect the :password_hash attribute name:

def user_params
  params.require(:user).permit(:username, :title, :firstName, :surname, :password_hash, :password_confirmation)
end

In this case, your database would need a password_hash column instead of password_digest to get it working using the sample code above. Of course, you could also re-use password_digest instead of password_hash, then replace password_hash in the above code with password_digest.

Notes

In both cases I use a view as you did with a password field:

<div class="form-group row col-md-12">
  <div class="col-md-6">
    <%= f.label :password, "New Password"%><br>
      <%= f.password_field :password, class:"form-control" %>
  </div>
</div>

The controller in my tests looked like this:

def update
  if @user.update(user_params)
    redirect_to @user, notice: 'User was successfully updated.'
  else
    render :edit
  end
end

Test app

I have also added this little test rails app using option 1 with has_secure_password into a Github repository @ https://github.com/cadamini/rails-bcrypt-ruby-test

user_38425980

Open app/models/user.rb and add the method has_secure_password to your User class. has_secure_passwordand password_digest work together in bcrypt, so both need to be present for it to work.

user_124556090
Related