NoamB/sorcery — Issue #157: Crypted password gets updated even if the record is invalid
Author: martinrehfeld
Created: 2011-11-24 07:41:10+00:00
State: open

Here's the deal. I have little form that let's the user change his password by entering `password` and `password_confirmation`. The controller has a standard `update` action that does an `#update_attributes` and depending on the return value calls it a success or failure. This works as expected, i.e. the user gets a validation error if `password` and `passworfd_confirmation` do not match. Cool so far.

Yet, internally Sorcery *does* update `crypted_password` when a new `password` is assigned (even if it does not match `password_confirmation`). The record is not being saved because it is invalid, though. So not a big problem.

But --- BIG but: When the activity logging goes ahead and does a `#update_attribute` on the `last_activity_at` column, the record will get saved without validation AND (this is Rails behaviour, I personally would call a bug, but they call it a feature) all dirty colums including `crypted_password` get updated together with `last_activity_at`. And the user ends up with a new password even though, the record is invalid and the controller told him, that the change could not be performed.

So either Sorcery should not touch the `crypted_password` at all when the record is invalid and/or the activity logging should make sure that only `last_activity_at` is being touched by it (this could be achieved by using `#update_all` with a condition on the `id` instead of using `#update_attribute`).

Thoughts?