How do you tell a form not to automatically include the database information?
I do not want the password to appear.
<% form_for :user, :url => user_url(@user), :html => { :method => :put } do |f| -%> <p>Username:<br /><%= f.text_field :username, :size => 40 %></p> <p>Email:<br /><%= f.text_field :email, :size => 60 %></p> <p>Password:<br /><%= f.password_field :password, :size => 60 %></p> <% end %>
Er, perhaps don't store the password in your model? Use password_field_tag otherwise.
How can I tell it not to store the password in the model. I know that it is pulling the properties directly from the database.
[[Please don't top post as it makes the discussion more difficult to follow.]]
How can I tell it not to store the password in the model. I know that it is pulling the properties directly from the database.
I believe what Rick is saying is don't store the password in the database at all. For example, you can hash the password (with a salt for better security) and store the hash and the salt in the database. Check out the acts_as_authenticated or restful_authentication plugins for examples of how this is done.
Michael Glaesemann grzm seespotcode net
If I understand correctly, the objective is to allow the user to enter a password which is then updated in the database, but you don't want the password displayed? Is that correct? Then if so, you could put the following in your model
def password # return nothing so no one ever sees # the password "" end
def password=(p) # if nothing provided and we already have a password set then don't overwrite # since we assume a password was set already. Otherwise # set the password if p.blank? return else write_attribute("password", p) end end
However this isn't a satisfactory real world solution. Several good password and authentication schemes have been mentioned. There's a good description one strategy in Rails Recipes on page 135.
Cheers, --Kip