Question

I am using the rails 3.2.x with devise to authenticate the user password.
On one page I am updating allowing user to update the his password. But even after providing the wrong current password, user can be able to update his/her password.

Same thing is happening with the rails console.

@user = user.update_attributes :password => "some_password"

updates the @user’s password.

How to get away with this trouble?

UPDATE:
I can update user password with wrong current_password parameter to update_attributes method like,

@user = user.update_attributes :password => "some_password", :current_password => "wrong_password"

Answer 1

figured it out,

instead of using

 user.update_attributes(params[:user])

one can use

user.update_with_password(params[:user])

This will insure that current password is valid.