Since you usually don’t store the password in the model, using the field that you put in the form should be enough to update it unless password.blank?and have a real password in the hashed_password field that you won’t put in the form.
Thanks to Ben (see below) for telling me to additionally protect your encrypted password with attr_protected, so that it cannot be directly obtained / updated from the form. +1
source
share