plataformatec/devise — pull request #2071 by VadimPushtaev (2012-09-25 06:16:54+00:00)
Title: New devise_attr_accessible option

Following #716

# Problem

Devise uses `update_attributes` in its controllers, so fields like `:name` and `:password` should be attr_accessible in your model. But it should be client's decision, not Devises's, what fields should be attr_accessible. Some people prefer to control all params by their own, for example.

There must be a way to say to Devise "don't rely on `attr_accessible`". But in this case, we want to provide some list of acceptable attributes to Devise so it can control them by its own.

# Solution

I implement new option: `devise_attr_accissble`.

If it is set:
1. Devise uses `update_attributes params, :without_protection => true`, so `attr_accessible` doesn't matter anymore.
2. Devise checks that any param in resource is among `devise_attr_accissble` list.

# Example

This is going to work:

```ruby
class User < ActiveRecord::Base
devise :database_authenticatable, :registerable, :encryptable,
:recoverable, :rememberable, :trackable, :validatable, :confirmable,
:devise_attr_accessible => [ :name, :password, :password_confirmation ]

attr_accessible #nothing
end
```