plataformatec/devise — Issue #1684: Slice will be called on nil if reset password params array not present
Author: mariovisic
Created: 2012-02-28 04:21:48+00:00
State: open

Heya

Getting some 500 errors on our production application. It seems that someone is trying to hit the reset password action devise/passwords#create without any params.

The controller runs:

# app/controllers/devise/passwords_controller.rb:11
#params[:user] here is nil
self.resource = resource_class.send_reset_password_instructions(params[resource_name])

which calls:

# lib/devise/models/recoverable.rb:105
recoverable = find_or_initialize_with_errors(reset_password_keys, attributes, :not_found)

which runs:

# lib/devise/models/authenticatable.rb:177
attributes = attributes.slice(*required_attributes)

So slice is eventually called on nil. I'm not too familiar with the internals but would changing the controller to run:

self.resource = resource_class.send_reset_password_instructions(params[resource_name] || [])

work OK?