devise, when trying to change a password WARNING: Can't mass-assign protected attributes: current_password

Question

with rails 3 + devise, I want a user to be able to change their password:

here's is the log output:

Started POST "/settings/password/update" for 127.0.0.1 at 2011-08-11 11:37:05 -0700
  Processing by SettingsController#password_update as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"QBZP/h0Xg1SOBWh0+JwzFRyC8X7pE50mx1CgeS6+iNY=", "user"=>{"current_password"=>"[FILTERED]", "password"=>"[FILTERED]", "password_confirmation"=>"[FILTERED]"}, "commit"=>"Change my password"}
  User Load (0.6ms)  SELECT "users".* FROM "users" WHERE "users"."id" = 3 LIMIT 1
  SQL (0.2ms)  BEGIN
WARNING: Can't mass-assign protected attributes: current_password
  AREL (0.7ms)  UPDATE "users" SET "encrypted_password" = '$2a$10$cjq9eWB41aqeukarMzyciO4adXB3g.gCSwP6OouV0HT9HZI3IVIa6', "updated_at" = '2011-08-11 18:37:06.326258' WHERE "users"."id" = 3
[paperclip] Saving attachments.
  SQL (25.7ms)  COMMIT
Redirected to http://localhost:3000/settings/account
Completed 302 Found in 556ms

Here is the controller method for password_update:

  def password_update

    @user = current_user

    if @user.update_attributes(params[:user])
      flash[:notice] = 'Password Updated'
      redirect_to '/settings/account'
    else
      flash[:notice] = 'Error'
      redirect_to '/settings/password'
    end

  end

Any ideas why this is happening? I'm not trying to set current_password but according to devise you need to pass that to update the password, right? Thanks

Answer 1

I prefer to override update_without_password method on User model

def update_without_password(params={})
  params.delete(:current_password)
  super(params)
end

Answer 2

Add attr_accessible :current_password to your user model.