# Login system - user password being updated

**URL:** <https://www.ruby-forum.com/t/login-system-user-password-being-updated/166511>\
**Category:** Rails\
**Created:** [April 26, 2009, 5:10pm UTC](https://www.ruby-forum.com/t/login-system-user-password-being-updated/166511 "2009-04-26T17:10:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![furrot](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/3da27b/32.png) [@furrot](https://www.ruby-forum.com/u/furrot)\
**Post date:** [April 26, 2009, 5:10pm UTC](https://www.ruby-forum.com/t/login-system-user-password-being-updated/166511/1 "2009-04-26T17:10:02Z")

</div>

I am developing a small site. The login system works fine and I am using  
the sha1 hashing alg to hash passwords. I have an admin side that can  
enable or disable users. The problem seems to lie in the disable  
(destroy) method. When I disable a user, it updates the password to a  
new password so when the user is re-enabled, I get an “invalid  
username/password” error and I have to reset the password. I cant see  
why it is doing this.

My destroy method is :

def destroy  
@user = User.find(params[:id])  
if @user.update\_attribute(:enabled, false)  
flash[:notice] = “User disabled”  
else  
flash[:error] = “There was a problem disabling this user.”  
end  
redirect\_to :action =\> ‘show’  
end

Anyone any ideas?

---

<div class="post-metadata">

**Author:** ![furrot](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/3da27b/32.png) [@furrot](https://www.ruby-forum.com/u/furrot)\
**Post date:** [April 26, 2009, 6:04pm UTC](https://www.ruby-forum.com/t/login-system-user-password-being-updated/166511/2 "2009-04-26T18:04:01Z")

</div>

I ended up kinda working it out. I now just reset the password and email  
the link to the user. Not 100% ideal but it works!

---

<div class="post-metadata">

**Author:** ![furrot](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/f/3da27b/32.png) [@furrot](https://www.ruby-forum.com/u/furrot)\
**Post date:** [April 26, 2009, 6:35pm UTC](https://www.ruby-forum.com/t/login-system-user-password-being-updated/166511/3 "2009-04-26T18:35:10Z")

</div>

Are you saying that after the update\_attribute the password field is  
also  
changed? If so do you have some sort of filter that might be running  
and  
changing it? Possibly you could put debugger traps at each point you  
change  
the password and check it is not getting there. Also have a look in the  
log  
to see what sql is being executed and if there are any unexpected write  
queries.  
Colin

2009/4/26 Stephen F. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)