Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Fix regression in has_secure_password.

If the confirmation was blank, but the password wasn't, it would still save.
  • Loading branch information...
commit 5d93ef8f459254f075616d37763611ad87d86b30 1 parent 6a6eae2
@pnc pnc authored steveklabnik committed
View
5 activemodel/CHANGELOG.md
@@ -1,3 +1,8 @@
+* Fix regression in has_secure_password. When a password is set, but a
+ confirmation is an empty string, it would incorrectly save.
+
+ *Steve Klabnik* and *Phillip Calvin*
+
* Deprecate `Validator#setup`. This should be done manually now in the validator's constructor.
*Nick Sutterer*
View
7 activemodel/lib/active_model/secure_password.rb
@@ -56,8 +56,9 @@ def has_secure_password(options = {})
include InstanceMethodsOnActivation
if options.fetch(:validations, true)
- validates_confirmation_of :password
+ validates_confirmation_of :password, if: lambda { |m| m.password.present? }
validates_presence_of :password, on: :create
+ validates_presence_of :password_confirmation, if: lambda { |m| m.password.present? }
before_create { raise "Password digest missing on new record" if password_digest.blank? }
end
@@ -106,9 +107,7 @@ def password=(unencrypted_password)
end
def password_confirmation=(unencrypted_password)
- unless unencrypted_password.blank?
- @password_confirmation = unencrypted_password
- end
+ @password_confirmation = unencrypted_password
end
end
end
View
9 activemodel/test/cases/secure_password_test.rb
@@ -94,4 +94,13 @@ class SecurePasswordTest < ActiveModel::TestCase
@user.password_confirmation = ""
assert @user.valid?(:update), "user should be valid"
end
+
+ test "will not save if confirmation is blank but password is not" do
+ @user.password = "password"
+ @user.password_confirmation = ""
+ assert_not @user.valid?(:create)
+
+ @user.password_confirmation = "password"
+ assert @user.valid?(:create)
+ end
end
Please sign in to comment.
Something went wrong with that request. Please try again.