# Problem recovering password

**URL:** <https://www.ruby-forum.com/t/problem-recovering-password/76081>\
**Category:** Engines\
**Created:** [March 3, 2006, 1:42am UTC](https://www.ruby-forum.com/t/problem-recovering-password/76081 "2006-03-03T01:42:33Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![crucoba](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/e8c25b/32.png) [@crucoba](https://www.ruby-forum.com/u/crucoba)\
**Post date:** [March 3, 2006, 1:42am UTC](https://www.ruby-forum.com/t/problem-recovering-password/76081/1 "2006-03-03T01:42:33Z")

</div>

I’ve installed LoginEngine, and the basics appear to work. However,  
when I  
attempt to recover my password, I end up with the failure you see at the  
end  
of this message. Now, looking at the code, this seems like it should  
always  
happen (unless Rails is doing magic I don’t know about – always a  
possibility).

Also, be aware, that this user was created as part of a migration from  
other  
data. Looking at the user in the database, thing seem reasonable to me.

------failure---------  
You have a nil object when you didn’t expect it!  
You might have expected an instance of ActiveRecord::Base.  
The error occured while evaluating nil.errors

Extracted source (around line #4):

1:

  
2: 
### Change Password
  
3:  
4: \<%= error\_messages\_for ‘user’ %\>  
5:  
6: 
  
7: 

Enter your new password in the fields below and click ‘Change  
Password’ to have a new password sent to your email inbox.

RAILS\_ROOT: script/…/config/…  
Application Trace | Framework Trace | Full Trace

./script/…/config/…/vendor/rails/actionpack/lib/action\_view/helpers/active\_record\_helper.rb:106:in  
`error_messages_for' #{RAILS_ROOT}/vendor/plugins/login_engine/app/views/user/change_password.rhtml:4 ./script/../config/../vendor/rails/actionpack/lib/action_view/base.rb:268:in`compile\_and\_render\_template’  
./script/…/config/…/vendor/rails/actionpack/lib/action\_view/base.rb:244:in  
`render_template' ./script/../config/../vendor/rails/actionpack/lib/action_view/base.rb:205:in`render\_file’  
./script/…/config/…/vendor/rails/actionpack/lib/action\_controller/base.rb:655:in  
`render_file' ./script/../config/../vendor/rails/actionpack/lib/action_controller/base.rb:595:in`render\_with\_no\_layout’  
./script/…/config/…/vendor/rails/actionpack/lib/action\_controller/layout.rb:220:in  
`render_without_benchmark' ./script/../config/../vendor/rails/actionpack/lib/action_controller/benchmarking.rb:53:in`render’  
/usr/lib/ruby/1.8/benchmark.rb:293:in `measure' ./script/../config/../vendor/rails/actionpack/lib/action_controller/benchmarking.rb:53:in`render’  
./script/…/config/…/vendor/plugins/login\_engine/app/controllers/user\_controller.rb:247:in  
`generate_filled_in' ./script/../config/../vendor/plugins/login_engine/app/controllers/user_controller.rb:69:in`change\_password’  
./script/…/config/…/vendor/rails/actionpack/lib/action\_controller/base.rb:853:in  
`perform_action_without_filters' ./script/../config/../vendor/rails/actionpack/lib/action_controller/filters.rb:332:in`perform\_action\_without\_benchmark’  
./script/…/config/…/vendor/rails/actionpack/lib/action\_controller/benchmarking.rb:69:in  
`perform_action_without_rescue' /usr/lib/ruby/1.8/benchmark.rb:293:in`measure’  
./script/…/config/…/vendor/rails/actionpack/lib/action\_controller/benchmarking.rb:69:in  
`perform_action_without_rescue' ./script/../config/../vendor/rails/actionpack/lib/action_controller/rescue.rb:82:in`perform\_action’  
./script/…/config/…/vendor/rails/actionpack/lib/action\_controller/base.rb:369:in  
`process_without_session_management_support' ./script/../config/../vendor/rails/actionpack/lib/action_controller/session_management.rb:116:in`process’  
./script/…/config/…/vendor/rails/railties/lib/dispatcher.rb:38:in  
`dispatch' ./script/../config/../vendor/rails/railties/lib/webrick_server.rb:117:in`handle\_dispatch’  
./script/…/config/…/vendor/rails/railties/lib/webrick\_server.rb:83:in  
`service' /usr/lib/ruby/1.8/webrick/httpserver.rb:104:in`service’  
/usr/lib/ruby/1.8/webrick/httpserver.rb:65:in `run' /usr/lib/ruby/1.8/webrick/server.rb:173:in`start\_thread’  
/usr/lib/ruby/1.8/webrick/server.rb:162:in `start_thread' /usr/lib/ruby/1.8/webrick/server.rb:95:in`start’  
/usr/lib/ruby/1.8/webrick/server.rb:92:in `start' /usr/lib/ruby/1.8/webrick/server.rb:23:in`start’  
/usr/lib/ruby/1.8/webrick/server.rb:82:in `start' ./script/../config/../vendor/rails/railties/lib/webrick_server.rb:69:in`dispatch’  
./script/…/config/…/vendor/rails/railties/lib/commands/servers/webrick.rb:59  
/usr/lib/ruby/site\_ruby/1.8/rubygems/custom\_require.rb:21:in `require' ./script/../config/../vendor/rails/activesupport/lib/active_support/dependencies.rb:214:in`require’  
./script/…/config/…/vendor/rails/railties/lib/commands/server.rb:28  
./script/server:3

---

<div class="post-metadata">

**Author:** ![crucoba](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/e8c25b/32.png) [@crucoba](https://www.ruby-forum.com/u/crucoba)\
**Post date:** [March 3, 2006, 10:33am UTC](https://www.ruby-forum.com/t/problem-recovering-password/76081/2 "2006-03-03T10:33:40Z")

</div>

Are you logged in when you try to do this?

On 3/2/06, David C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> ------failure---------  
> 5:  
> ./script/…/config/…/vendor/rails/actionpack/lib/action\_view/base.rb:268:in  
> `render_without_benchmark' `perform\_action\_without\_filters’  
> `process_without_session_management_support' /usr/lib/ruby/1.8/webrick/server.rb:162:in `start\_thread’  
> ./script/…/config/…/vendor/rails/railties/lib/commands/server.rb:28  
> ./script/server:3
> 
> * * *
> 
> engine-users mailing list  
> removed\_email\_address@domain.invalid  
> [http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.org](http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.org)

–

- J \*  
~

---

<div class="post-metadata">

**Author:** ![crucoba](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/e8c25b/32.png) [@crucoba](https://www.ruby-forum.com/u/crucoba)\
**Post date:** [March 3, 2006, 12:22pm UTC](https://www.ruby-forum.com/t/problem-recovering-password/76081/3 "2006-03-03T12:22:07Z")

</div>

No, I’m not logged in. I’m trying to test the situation after I migrate  
users  
over, and users have to gain access to the site without knowing a  
password.

Looking at the code, I don’t see how the link emailed to me could  
possibly  
work, as the action seems to assume you are logged in, which defeats the  
purpose.

David

---

<div class="post-metadata">

**Author:** ![crucoba](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/e8c25b/32.png) [@crucoba](https://www.ruby-forum.com/u/crucoba)\
**Post date:** [March 3, 2006, 12:34pm UTC](https://www.ruby-forum.com/t/problem-recovering-password/76081/4 "2006-03-03T12:34:16Z")

</div>

But the link I’m getting in my email is not to authorize, but to  
“change\_password”.

---

<div class="post-metadata">

**Author:** ![crucoba](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/e8c25b/32.png) [@crucoba](https://www.ruby-forum.com/u/crucoba)\
**Post date:** [March 3, 2006, 12:28pm UTC](https://www.ruby-forum.com/t/problem-recovering-password/76081/5 "2006-03-03T12:28:09Z")

</div>

The authorize method has special handling for logging in via a token  
(login\_engine/lib/login\_engine/authenticated\_system.rb):

```
def user?
  # First, is the user already authenticated?
  return true if not session[:user].nil?

  # If not, is the user being authenticated by a token?
  id = params[:user_id]
  key = params[:key]
  if id and key
    session[:user] = User.authenticate_by_token(id, key)
    return true if not session[:user].nil?
  end

  # Everything failed
  return false
end

```

i.e. when it checks for a logged in user, if an ID and Key parameter  
are both present it will attempt to authenticate you based on that.  
That would be the place to start debugging…

- james

On 3/3/06, David C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> > > to me.  
> > > 3:  
> > > ive\_record\_helper.rb:106:in `error_messages_for' ./script/../config/../vendor/rails/actionpack/lib/action_controller/base. ./script/../config/../vendor/plugins/login_engine/app/controllers/user_co ./script/../config/../vendor/rails/actionpack/lib/action_controller/rescu `service’  
> > > ./script/…/config/…/vendor/rails/railties/lib/commands/servers/webrick.  
> > > [http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.or](http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.or)  
> > > engine-users mailing list  
> > > removed\_email\_address@domain.invalid  
> > > [http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.org](http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.org)

–

- J \*  
~

---

<div class="post-metadata">

**Author:** ![crucoba](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/e8c25b/32.png) [@crucoba](https://www.ruby-forum.com/u/crucoba)\
**Post date:** [March 3, 2006, 12:46pm UTC](https://www.ruby-forum.com/t/problem-recovering-password/76081/6 "2006-03-03T12:46:23Z")

</div>

There is no ‘authorize’ action, but the filter will cause the user?  
method to be called, which should then authenticate you on _any_  
action so long as a valid id and key parameter is given. Therefore,  
calling the ‘change\_password’ method will:

1. cause the ‘login\_required’ filter to be called (you _are_ using  
before\_filter :login\_required in your application.rb, right?),
2. which in turn checks to see if the current action requires any  
authentication
3. if the action does require authentication, it then checks for a  
logged in user (method: user?) and if that user is authorized for this  
particular action (method: authorize?(user))

If the user? method manages to return true (either by you already  
being logged in, or by authenticating you against a key and id  
parameter) then you will be allowed to perform the given action, which  
in this case is change\_password.

- james

On 3/3/06, David C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> > ```
> > return true if not session[:user].nil?
> > return false
> > 
> > ```
> > 
> > > users over, and users have to gain access to the site without knowing a
> > > 
> > > > > reasonable to me.  
> > > > > 3:  
> > > > > ./script/…/config/…/vendor/rails/actionpack/lib/action\_view/helpers
> > > > > 
> > > > > ase. rb:595:in `render_with_no_layout' r_co ntroller.rb:69:in `change\_password’  
> > > > > escu e.rb:82:in `perform_action' /usr/lib/ruby/1.8/webrick/httpserver.rb:104:in `service’  
> > > > > ick. rb:59  
> > > > > [http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engine](http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engine)
> > 
> > engine-users mailing list  
> > removed\_email\_address@domain.invalid  
> > [http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.org](http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.org)
> 
> * * *
> 
> engine-users mailing list  
> removed\_email\_address@domain.invalid  
> [http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.org](http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.org)

–

- J \*  
~

---

<div class="post-metadata">

**Author:** ![crucoba](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/e8c25b/32.png) [@crucoba](https://www.ruby-forum.com/u/crucoba)\
**Post date:** [March 3, 2006, 12:52pm UTC](https://www.ruby-forum.com/t/problem-recovering-password/76081/7 "2006-03-03T12:52:26Z")

</div>

On Friday 03 March 2006 12:34 am, David C. wrote:

> Ah! I think I know the problem, but haven’t verified it yet. Is  
> user\_controller assuming that I’ve added the login\_required filter to  
> application\_controller? I haven’t. I’d wanted to add explicit filters for  
> those few actions that are admin related.
> 
> I’ll try that and let you know.

Yes, that fixed the problem. Seems to me the user\_controller should  
have this  
in it.

---

<div class="post-metadata">

**Author:** ![crucoba](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/e8c25b/32.png) [@crucoba](https://www.ruby-forum.com/u/crucoba)\
**Post date:** [March 3, 2006, 12:58pm UTC](https://www.ruby-forum.com/t/problem-recovering-password/76081/8 "2006-03-03T12:58:28Z")

</div>

If you want to add it in to only the user\_controller, you can mix this  
in in the normal engines style, i…e  
RAILS\_ROOT/app/controllers/user\_controller.rb:

class UserController \< ApplicationController  
before\_filter :login\_required  
end

- james

On 3/3/06, David C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> in it.
> 
> * * *
> 
> engine-users mailing list  
> removed\_email\_address@domain.invalid  
> [http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.org](http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.org)

–

- J \*  
~

---

<div class="post-metadata">

**Author:** ![crucoba](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/e8c25b/32.png) [@crucoba](https://www.ruby-forum.com/u/crucoba)\
**Post date:** [March 3, 2006, 12:49pm UTC](https://www.ruby-forum.com/t/problem-recovering-password/76081/9 "2006-03-03T12:49:24Z")

</div>

Ah! I think I know the problem, but haven’t verified it yet. Is  
user\_controller assuming that I’ve added the login\_required filter to  
application\_controller? I haven’t. I’d wanted to add explicit filters  
for  
those few actions that are admin related.

I’ll try that and let you know.