That's actually safe because password & password_confirmation are
'virtual fields' -- the real data is stored in crypted_password.
Bryan
On 10-11-16 08:03 PM, tommy wrote:
Hi Guys,
I want users to be anonymous on my site, so I set the following in the
user model...
def view_permitted?(field)
acting_user.administrator? || (acting_user == self) ||
self.id==nil
end
But then the reset password page using the forgot password link shows
no fields.
So I've done the following:
def view_permitted?(field)
acting_user.administrator? || (acting_user == self) || self.id ==
nil || field == :password || field == :password_confirmation
end
Which just feels wrong. Is this the best way to handle this problem?
Is it possible to check the key from view_permitted?
Thanks,
Tommy
--
You received this message because you are subscribed to the Google Groups "Hobo
Users" group.
To post to this group, send email to [email protected].
To unsubscribe from this group, send email to
[email protected].
For more options, visit this group at
http://groups.google.com/group/hobousers?hl=en.
