# Agile Web Dev w/Rails - Password Change

**URL:** <https://www.ruby-forum.com/t/agile-web-dev-w-rails-password-change/124662>\
**Category:** Rails\
**Created:** [December 31, 2007, 7:58pm UTC](https://www.ruby-forum.com/t/agile-web-dev-w-rails-password-change/124662 "2007-12-31T19:58:02Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![musty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/77aa72/32.png) [@musty](https://www.ruby-forum.com/u/musty)\
**Post date:** [December 31, 2007, 7:58pm UTC](https://www.ruby-forum.com/t/agile-web-dev-w-rails-password-change/124662/1 "2007-12-31T19:58:02Z")

</div>

Happy New Year everyone.  
Just wondering if anyone has coded the ability to allow a user to change  
their password following the way the book (second edition) implements  
administration.  
Seems like I should be able to cut out the  
password/password\_confirmation portion of ‘add\_user’ form to create a  
‘change\_pass’ form. The problem is I’m not sure how to go about having  
it confirm the password and implementing the change. Seems the code will  
only do that for new users.  
Thanks, any help appreciated…Bill

---

<div class="post-metadata">

**Author:** ![musty](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/77aa72/32.png) [@musty](https://www.ruby-forum.com/u/musty)\
**Post date:** [December 31, 2007, 10:08pm UTC](https://www.ruby-forum.com/t/agile-web-dev-w-rails-password-change/124662/2 "2007-12-31T22:08:04Z")

</div>

On 12/31/07, Bill McG [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Happy New Year everyone.  
> Just wondering if anyone has coded the ability to allow a user to change  
> their password following the way the book (second edition) implements  
> administration.

Sure.

> Seems like I should be able to cut out the  
> password/password\_confirmation portion of ‘add\_user’ form to create a  
> ‘change\_pass’ form. The problem is I’m not sure how to go about having  
> it confirm the password and implementing the change. Seems the code will  
> only do that for new users.

You get new salt and rehash the password. I actually adjusted mine so  
it re-salts every time the password gets updated.

def password=( passwd )  
@password = passwd  
return if passwd.blank?  
self.passwd\_salt = User.salt  
self.passwd\_hash = User.hash\_password( @password, self.passwd\_salt )  
end

private

def self.salt  
Digest::SHA1.hexdigest( rand.to\_s )  
end

def self.hash\_password( password, salt )  
Digest::SHA1.hexdigest( password + salt )  
end

–  
Greg D.  
[http://destiney.com/](http://destiney.com/)