Updating model

hello,

i am writing a simple user login system.

when registering a user account, i have two field:

password
password_confirmation

which are validated using

validates_presence_of
validates_confirmation_of

and these are then used to generate a password hash which is stored in
my database

when i want to update the record (without changing the password and
entering new values for password and password_confirmation), using the
update_attributes method, i am getting errors thrown up by this
validation.

i want to be able to update the record, even if the user does not
specify a new password

thanks

Jon H. wrote:

maybe my post wasn’t too clear.

basically, what i am after is a way of selectively validating certain
fields of the model, i.e.

when creating a new object and saving it to the database, i want to
validate the presence of username, password and password_confirmation,
and validate confirmation of password

but, when updating the user’s profile (name, address etc) i want to
ignore the password validation (i’ll have a seperare form for changing
password)

hope that’s clearer

Could you post the code that you are trying that throws errors?

Post the code where you try to update fields and save the query. Also,
post a few segments on the password stuff from the model.

-Ben L.

maybe my post wasn’t too clear.

basically, what i am after is a way of selectively validating certain
fields of the model, i.e.

when creating a new object and saving it to the database, i want to
validate the presence of username, password and password_confirmation,
and validate confirmation of password

but, when updating the user’s profile (name, address etc) i want to
ignore the password validation (i’ll have a seperare form for changing
password)

hope that’s clearer

Ben L. wrote:

Jon H. wrote:

maybe my post wasn’t too clear.

basically, what i am after is a way of selectively validating certain
fields of the model, i.e.

when creating a new object and saving it to the database, i want to
validate the presence of username, password and password_confirmation,
and validate confirmation of password

but, when updating the user’s profile (name, address etc) i want to
ignore the password validation (i’ll have a seperare form for changing
password)

hope that’s clearer

Could you post the code that you are trying that throws errors?

Post the code where you try to update fields and save the query. Also,
post a few segments on the password stuff from the model.

-Ben L.

I’m running the same scheme, and here’s how I update the name of a user:

@thisUser = User.find_by_id(session[:user_id])
@thisUser[0].name = “new name!!!”
@thisUser[0].update()
@thisUser[0].save

An easier way to do this would be
User.update(session[:user_id], {:name => ‘new name!!!’})

it shouldn’t throw any errors about passwords, unless you have it rigged
so it checks the password each time you try to update the entry.

Jon H. wrote:

hi ben

i have tried your method of updating, and it’s throwing up the password
validation problems again. i probably haven’t rigged up the validation
correctly for what i am trying to do.

here is the relevant code from my user model:

class User < ActiveRecord::Base
attr_accessor :password, :password_confirmation
attr_protected :admin, :enabled, :password_salt, :password_hash
validates_uniqueness_of :username
validates_presence_of :username, :email, :password,
:password_confirmation
validates_confirmation_of :password

def before_create
salt = [Array.new(6){rand(256).chr}.join].pack(“m”).chomp
self.password_salt = salt
self.password_hash = User.hash_password(self.password, salt)
end

def after_create
@password = nil
@password_confirmation = nil
end

end

and then in my user management controller here is the update method:

def update
@user = User.find(params[:id])
if @user.update_attributes(params[:user])
flash[:notice] = ‘User was successfully updated.’
redirect_to :action => ‘show’, :id => @user
else
render :action => ‘edit’
end
end

my understanding of update_attributes was to update and validate only
those supplied in params[:user] which afaik comes from my update form,
and therefore does not have the password and password_confirmation
fields

thanks

the first thing that jumps out at me is:

validates_presence_of :username, :email, :password,
:password_confirmation

then you have

def after_create
@password = nil
@password_confirmation = nil
end

So when you create, it validates that there’s a password. After you
have created your user with a password, it sets the password to nil.
Once you try to update a field, it does the validation methods again,
and sure enough validates_presence of :password and
:password_confirmation fail.

I think that’s what it is - lemme know.

-Ben L.

i don’t actually have password and password_confirmation fields in my
database, since i’m just storing the hash and salt obviously. so when i
load the record from the database using find() given the user id, these
are set to nil anyway.

the code i am using is based on that given in the ‘agile web development
with ruby’ book, and it sets the plaintext password to nil to prevent it
from being stored in session data (when i get round to that)

any suggestions?

hi ben

i have tried your method of updating, and it’s throwing up the password
validation problems again. i probably haven’t rigged up the validation
correctly for what i am trying to do.

here is the relevant code from my user model:

class User < ActiveRecord::Base
attr_accessor :password, :password_confirmation
attr_protected :admin, :enabled, :password_salt, :password_hash
validates_uniqueness_of :username
validates_presence_of :username, :email, :password,
:password_confirmation
validates_confirmation_of :password

def before_create
salt = [Array.new(6){rand(256).chr}.join].pack(“m”).chomp
self.password_salt = salt
self.password_hash = User.hash_password(self.password, salt)
end

def after_create
@password = nil
@password_confirmation = nil
end

end

and then in my user management controller here is the update method:

def update
@user = User.find(params[:id])
if @user.update_attributes(params[:user])
flash[:notice] = ‘User was successfully updated.’
redirect_to :action => ‘show’, :id => @user
else
render :action => ‘edit’
end
end

my understanding of update_attributes was to update and validate only
those supplied in params[:user] which afaik comes from my update form,
and therefore does not have the password and password_confirmation
fields

thanks

def update
@user = User.find(params[:id])
if @user.update_attributes(params[:user])
flash[:notice] = ‘User was successfully updated.’
redirect_to :action => ‘show’, :id => @user
else
render :action => ‘edit’
end
end

change to:
def update
def update
@user = User.find(params[:id])

add these three lines
@user.name = params[:user].name <— note down below
@user.update()
if @user.save

or this line
if User.update(params[:id], {:name => params[:user].name})

Note: that line is assuming your form contains this
<%= text_field ‘user’, ‘name’ %>

-Ben L.

Ben L. wrote:

def update
@user = User.find(params[:id])
if @user.update_attributes(params[:user])
flash[:notice] = ‘User was successfully updated.’
redirect_to :action => ‘show’, :id => @user
else
render :action => ‘edit’
end
end

change to:
def update
def update
@user = User.find(params[:id])

add these three lines
@user.name = params[:user].name <— note down below
@user.update()
if @user.save

or this line
if User.update(params[:id], {:name => params[:user].name})

Note: that line is assuming your form contains this
<%= text_field ‘user’, ‘name’ %>

-Ben L.

the problem is that you’re using update_attributes vs. update_attribute.

update_attribues
“Updates all the attributes from the passed-in Hash and saves the
record. If the object is invalid, the saving will fail and false will be
returned.”

that params[:user] you’re passing it obviously only has this field:
<%= text_field ‘user’, ‘name’ %>

if it had:
<%= text_field ‘user’, ‘name’ %>
<%= text_field ‘user’, ‘password’ %>
<%= text_field ‘user’, ‘password_confirmation’ %>

then that syntax would have been fine, because it would have done
update_attribues and it would have passed all of the validates
requirements.

if you’re delving into agile, you should keep
http://api.rubyonrails.com/ handy. it’s important to know how to use it

  • it can really save you time. I have a copy of it downloaded through
    Web Devil (for OSX) so I can program and get any syntax help I need
    without the internet.

the problem with update_attribute is that, however, the attribute
updated is not subjest to any validation. so, for example, it would be
easy to make the mistake of updating the ‘username’ to either nil or
perhaps another username whihc already exists.

i guess what i’m trying to do if update a subset of fields, performing
validation on only those fields.

thanks

Jon H. wrote:

the problem with update_attribute is that, however, the attribute
updated is not subjest to any validation. so, for example, it would be
easy to make the mistake of updating the ‘username’ to either nil or
perhaps another username whihc already exists.

i guess what i’m trying to do if update a subset of fields, performing
validation on only those fields.

thanks

then just use update_attribute not update_attributes - that should be
exactly what you need.

On 7/18/06, Ben L. [email protected] wrote:

thanks

You can restrict the validation to occur only on create. That way, when
the
user is updated it won’t trip the validation trip switch.

validate_presence_of :password, :on => :create
validates_confirmation_of :password, :on => :create

Alternatively, if you need more control use the :if option to point to a
proc or a method to test if validation should occur.

validate_presence_of :password, :if => Proc.new{ |model| model.something

a_condition }
or
validate_presence_of :password, :if =>
:some_method_that_evaluates_to_true_or_false

Ben L. wrote:

then just use update_attribute not update_attributes - that should be
exactly what you need.

i have tried this, but validation checks are not performed on the
attribute being updated. for example i can update the username to
either nil or to another existing username

Daniel ----- wrote:

You can restrict the validation to occur only on create. That way, when
the
user is updated it won’t trip the validation trip switch.

validate_presence_of :password, :on => :create
validates_confirmation_of :password, :on => :create

Alternatively, if you need more control use the :if option to point to a
proc or a method to test if validation should occur.

validate_presence_of :password, :if => Proc.new{ |model| model.something

a_condition }
or
validate_presence_of :password, :if =>
:some_method_that_evaluates_to_true_or_false

ok i’ll give that kinda thing a try. thanks :slight_smile:

Daniel ----- wrote:

You can restrict the validation to occur only on create. That way, when
the
user is updated it won’t trip the validation trip switch.

validate_presence_of :password, :on => :create
validates_confirmation_of :password, :on => :create

Alternatively, if you need more control use the :if option to point to a
proc or a method to test if validation should occur.

validate_presence_of :password, :if => Proc.new{ |model| model.something

a_condition }
or
validate_presence_of :password, :if =>
:some_method_that_evaluates_to_true_or_false

so, is the best way of doing this to have a couple of flags in my user
model

updating_profile
updating_password

for example, which are set by the update methods in my controller, and
to use validation in my user model something like?

validates_presence_of :password, :password_confirmation :if =>
updating_password == true

sorry, you can probably tell this is my first time using ruby on rails!

is it possible to control whether the validates_* statements are
executed directly depending on the method in the controller through
which the model fields are being updated?

Alan F. wrote:

Jon H. wrote:

when i want to update the record (without changing the password and
entering new values for password and password_confirmation), using the
update_attributes method, i am getting errors thrown up by this
validation.

I think adding

:on => :create

to the end of your validates_* lines will restrict the validation to
occur only on create, not update.

Alan

yeah, that should do it for now - but i think when i come to create a
form allowing the user to update their password, then i’ll need that
password validation to kick in. i think i need to use :if =>
something

Jon H. wrote:

when i want to update the record (without changing the password and
entering new values for password and password_confirmation), using the
update_attributes method, i am getting errors thrown up by this
validation.

I think adding

:on => :create

to the end of your validates_* lines will restrict the validation to
occur only on create, not update.

Alan

On 7/19/06, Jon H. [email protected] wrote:

proc or a method to test if validation should occur.

http://lists.rubyonrails.org/mailman/listinfo/rails
One really good place to have a look at this kind of code is
techno-weenies
acts_as_authenticated. It really is a good plugin for this. Very small
and
light weight. Doesn’t get in your way.

http://svn.techno-weenie.net/projects/plugins/acts_as_authenticated/generators/authenticated/templates/model.rb

He uses a method password_required?
A quick extract of the pertinent bits of the user model

Virtual attribute for the unencrypted password

attr_accessor :password

validates_presence_of :password, :if =>
:password_required?
validates_presence_of :password_confirmation, :if =>
:password_required?
validates_length_of :password, :within => 4…40, :if =>
:password_required?
validates_confirmation_of :password, :if =>
:password_required?

before_save :encrypt_password

Encrypts some data with the salt.

def self.encrypt(password, salt)
Digest::SHA1.hexdigest("–#{salt}–#{password}–")
end

Encrypts the password with the user salt

def encrypt(password)
self.class.encrypt(password, salt)
end

protected
# before filter
def encrypt_password
return if password.blank?
self.salt =
Digest::SHA1.hexdigest("–#{Time.now.to_s}–#{login}–")
if new_record?
self.crypted_password = encrypt(password)
end

def password_required?
  crypted_password.blank? || !password.blank?
end

Hope that gets you started.

On Mon, Jul 17, 2006 at 06:47:59PM +0200, Jon H. wrote:

hello,

i am writing a simple user login system.

did you try the LoginGenerator (or any of the alternative login systems
available) ?

see
http://wiki.rubyonrails.org/rails/pages/HowToQuicklyDoAuthenticationWithLoginGenerator
and
http://wiki.rubyonrails.org/rails/pages/LoginGenerator

Even if none of the solutions mentioned there does fit your needs, they
might provide a good starting point.

Jens

Daniel ----- wrote:

One really good place to have a look at this kind of code is
techno-weenies
acts_as_authenticated. It really is a good plugin for this. Very small
and
light weight. Doesn’t get in your way.

thanks Daniel, i’ll give those technique’s a try

This forum is not affiliated to the Ruby language, Ruby on Rails framework, nor any Ruby applications discussed here.

| Privacy Policy | Terms of Service | Remote Ruby Jobs