plataformatec/devise — pull request #2582 by tod-uma (2013-08-20 20:43:15+00:00)
Title: Allowed updating of attributes without a password if password_required? resolves to false.

I am using omniauth plugins for all of my authentications, so no user has or needs passwords. I ran into a problem where I was trying to add some custom fields for my users, but I kept getting "Unpermitted parameters:" even though I had allowed it using devise_parameter_sanitizer.for. I finally tracked the problem down to the line of code I replaced in this commit. I felt it was better to fix this in the upstream rather than just overriding the update method in my code. Devise already has the "password_required?" infrastructure, so why not use it?