plataformatec/devise — Issue #1620: Problems trying' to update the user profile info without password
Author: foncho
Created: 2012-02-03 07:50:06+00:00
State: open

Hi folks!

I've been working for so long with this incredible tool for creating login and accounts management system, but today, when I have been encourage to upgrade from 1.5.3 to 2.0, I have encountered some problems, and I don't know what to do right now, due to I couldn't be able to find out the solution through Google or by my own.

The thing is the next:

When I access to my profile page and I want to edit and update some info, and I don't want to provide the password, I find the next message:

```ruby
ActiveModel::MassAssignmentSecurity::Error in Users::RegistrationsController#update

Can't mass-assign protected attributes: current_password
```

I have tried to add :current_password to attr_accessible directive in my model, and the response is "undefined method :current_password".

I have also tried the wiki solution and the response is the same than above.

I have also tried the "update_without_password(params[:user])" variant, but the result is the same again.

My Users::RegistrationsController is the next:

```ruby
class Users::RegistrationsController < Devise::RegistrationsController
def edit
@user = current_user
end
def update
@user = User.find(current_user)
debugger
if @user.update_attributes(params[:user])
sign_in @user, :bypass => true
redirect_to :back
else
render "edit"
end
end

def destroy
resource.destroy
sign_out_and_redirect(self.resource)
set_flash_message :alert, :destroyed
end
end
```

And my model is the next:

```ruby
class User < ActiveRecord::Base
has_many :galleries, :dependent => :destroy
accepts_nested_attributes_for :galleries, :allow_destroy => true
has_many :comments, :dependent => :destroy
has_many :attendees, :dependent => :destroy

# Include default devise modules. Others available are:
# :token_authenticable, :lockable, :encryptable, :trackable, :timeoutable
devise :database_authenticatable, :registerable, :recoverable, :validatable, :omniauthable,
:rememberable, :trackable, :confirmable

has_attached_file :photo, :styles => { :small => "100x", :medium => "166x", :large => "300x", :thumb => "60x" },
:url => "/assets/users/:id/:style/:basename.:extension",
:path => ":rails_root/app/assets/images/users/:id/:style/:basename.:extension"

validates_attachment_size :photo, :less_than => 2.megabytes

# Setup accessible (or protected) attributes for your model
attr_accessible :email, :password, :password_confirmation, :name, :surname, :birthday, :facebook_id, :photo,
:gender, :facebook_uid, :music_preference, :fb_token, :remember_me, :admin

validates :gender, :presence => true

# Validamos que quien se registra es mayor de 16 años
validates :birthday, :inclusion => { :in => Date.new(1920)..Time.now.years_ago(16).to_date }

# Calculamos la edad del usuario
def age(user_id)
user = User.find(user_id)
((Date.current - user.birthday) / 365).floor unless user.birthday.nil?
end

# Recuento de usuarios totales
def number_of_users
User.all.count
end

# Autenticamos por Facebook
def self.find_for_facebook_oauth(access_token, signed_in_resource=nil)
data = access_token[:extra][:rawinfo]
if user = User.find_by_email(data[:email])
user
else
birthday = data[:birthday]
# Por motivos de BBDD es necesario parsear los datos que nos llegan de FB para alojarlos correctamente en Postgres
date = Date.strptime(birthday, "%m/%d/%Y")
user = User.create!(
:email => data[:email],
:password => Devise.friendly_token[0, 20],
:name => data[:first_name],
:surname => data[:last_name],
:birthday => date,
:gender => data[:gender],
:photo => access_token[:info][:image],
:facebook_uid => access_token[:uid],
:fb_token => access_token[:credentials][:token] # Importante para hacer un retrieve de la foto de los perfiles de FB
)
end
end

# Registro de nuevos usuarios para Facebook
def self.create_with_omniauth(auth)
create! do |user|
user.email = auth[:info][:email]
user.name = auth[:info][:first_name]
user.surname = auth[:info][:last_name]
user.birthday = auth[:extra][:raw_info][:birthday]
user.gender = auth[:extra][:raw_info][:gender]
user.facebook_uid = auth[:uid]
user.fb_token = auth[:credentials][:token]
end
end
end
```

Could you try guys to help me?

Thx in advance!

FoN