Rails - update_attributes coming up against validations

Question

So I've got a user model, with login, email address, password, password confirmation, name, avatar (picture), etc. There are validations on the first 5, basically stating that all 5 need to exist in order to create a new model.

However, this causes problems for me where updates are concerned.

I've got an edit page, where the user can only edit their name and avatar. I'm not currently intending to let them change their login, and I wish to do an email and password change from a different page.

So the edit form looks like this:

<% form_for @user, :html => { :multipart => true } do |u| %>
 <p>
  <label>Name:</label>
  <%= u.text_field :name %>
 </p>
 <p>
  <label>Avatar:</label>
  <%= display_user_avatar %>
  <%= u.file_field :avatar%>
 </p>
 <p>
  <%= submit_tag %>
 </p>
<% end %>

If I attempt to do a @user.update_attributes(params[:user]), then because the only 2 params are name and avatar, the update fails, since stuff like password, password confirmation, email, etc are required to validate the entry, and they simply don't exist in that form.

I can get around this by doing @user.update_attribute(:name, params[:user][:name]), but then I worry about whether avoiding validations is a Good Thing™ or not. Especially with regards to something like password updates, where I do need to validate the new password.

Is there another way?

And if I were to do this simply using update_attribute for :name and :avatar, how would I go about doing it?

Would this work?

params[:user].each do |attribute|
  @user.update_attribute(attribute, params[:user][attribute])
end

Is this an acceptable way to do this...?

---

--edit as follow up --
Okie, I tried as you suggested and did

  def update
    @user = User.find_by_login(params[:id])
    if @user.update_attributes!(params[:user])
      redirect_to edit_user_path(@user)
    else
      flash[:notice] = @user.errors
      redirect_to edit_user_path(@user)
    end
  end

So it's doing the ! version, and the exception caught & displayed in the browser is:

Validation failed: Password is too short (minimum is 5 characters)

The info in the server log is:

Processing UsersController#update (for 127.0.0.1 at 2010-07-18 11:56:59) [PUT]
  Parameters: {"user"=>{"name"=>"testeeeeee"}, "commit"=>"Save changes", "action"=>"update", "_method"=>"put", "authenticity_token"=>"BMEGRW/pmIJVs1zlVH2TtZX2TQW8soeCXmMx4kquzMA=", "id"=>"tester", "controller"=>"users"}

Urm. Looking at this, I just realised that it is submitting "id"=>"tester". Now, I have my routes set up so that it is showing the users login name, instead of the user_id... Could that be why? It is attempting to find a update a user with user_id == tester, but since it doesn't exist, it attempts to create one instead? Is it actually something I'm doing wrong due to the route?

Hmmm... rake routes tells me that the route is:

edit_user GET    /users/:id/edit(.:format)                             {:action=>"edit", :controller=>"users"}
          PUT    /users/:id(.:format)                                  {:action=>"update", :controller=>"users"}

And I set up the route like that in the user.rb file:

  def to_param
    "#{login}"
  end

but it's definitely been displaying login instead of id all this time. But I'm also doing right at the beginning of the update action, a @user = User.find_by_login(params[:id]), and then updating that @user.

I'm very confused. >.<

---

Second update:

My User.rb validation stuff are as follows:

  validates_length_of :login, :within => 3..20
  validates_length_of :password, :within => 5..20
  validates_presence_of :login, :email, :password, :password_confirmation, :salt, :name, :on => :create
  validates_uniqueness_of :login, :case_sensitive => false
  validates_confirmation_of :password
  validates_format_of :email, :with => /^([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})$/i, :message => "format is invalid."
  attr_accessor :password, :password_confirmation

And the hashed_password section is here:

  def password=(pass)
    @password = pass
    self.salt = User.random_string(10) if !self.salt?
    self.hashed_password = User.encrypt(@password, self.salt)
  end

u.attributes gives me

>> u.attributes
=> {"salt"=>"NHpH5glxsU", "name"=>"test er", "avatar_updated_at"=>nil, "updated_at"=>Sat Jul 17 07:04:24 UTC 2010, "avatar_file_size"=>nil, "avatar_file_name"=>nil, "hashed_password"=>"84f8675c1ed43ef7f8645a375ea9f867c9a25c83", "id"=>1, "avatar_content_type"=>nil, "login"=>"tester", "email"=>"[email protected]", "created_at"=>Fri May 07 10:09:37 UTC 2010}

Urmmm... Ok, so it's what you said, about the virtual attribute password being actually nonexistent... So how do I get around that? Bugger, here I thought I was being smart fiddling with my own authentication code...

How easy is it to change to one of those authentication plugins? Will I need to create a new User model? Or should the plugin be able to work with my current one?

Thanks for all the help so far, btw! :D

Answer 1

I've checked this and a partial update of just 2 attributes via update_attributes works fine. All the other attributes are left with their previous values, meaning that the validation shouldn't fail. A couple of things to try:

• In your controller action are you loading the user via User.find? i.e. are you starting from a valid model.
• Are you sure the update is failing due to validation errors? Try replacing the update_attributes with update_attributes!. The latter will throw an exception if the update fails due to validation. Or check @user.errors after the attempted update to confirm which validation has failed.

Update

If User.find_by_login doesn't find a matching record it will return nil and won't create a new record for you. Is it possible that the tester user in the database has a password that is too short? Maybe that user was created before you put the validations in your code? Are you using any kind of plugin or callback to encrypt user passwords before saving the records? Is password actually a virtual attribute that isn't saved and the actual password is in a field like encrypted_password?

Try this from script/console (use the same environment as you are testing the app with - development or production)

> user = User.find_by_login 'tester'
> user.valid?
> user.attributes

The user.valid? will return true of false and will tell you whether the user is valid to start with, before you even try an update.

Update 2 (fixing the validation)

In terms of fixing your own code, you could add a method like the following to your User model:

def password_validation_required?
  hashed_password.blank? || [email protected]?
end

and then update all your password related validation rules so that they only apply if this method returns true e.g.

validates_length_of :password, :within => 5..20, 
  :if => :password_validation_required?

What this is saying is only do the password validation rule if we don't yet have a hashed_password (on a new user for example) or if a new plain text password has been specified via password=. If the user already has a password and it is being left unchanged then skip the password validation.

You are right to be considering using a plugin though. Writing your own authentication code can be an interesting excercise and can be required if you have some unusual requirements. The down side is that there can be security issues that you haven't thought of. Retrofitting something like restful_authentication to your app shouldn't be too bad. You might just need to rename one or two fields on your User model.