设计:仅在某些情况下询问密码

Question

我正在开发一个使用Rails和Devise进行用户身份验证的应用程序.我想知道是否有办法只询问密码进行一些更改.

例如,我希望在以下情况下询问密码:

• 删除帐户
• 更改密码

我希望用户可以在没有任何密码的情况下自由编辑其他字段,例如:

• 名称
• 用户名
• 阿凡达

所以,我想要一种方法来交换这两种方法.我怎么解决这个问题？

编辑:

在Devise的文档中我发现了这个并且它工作正常,它只允许在我输入密码时更改密码和电子邮件:

def update
    @user = User.find(current_user.id)

    successfully_updated = if needs_password?(@user, params)
        @user.update_with_password(params[:user])
    else
        # remove the virtual current_password attribute update_without_password
        # doesn't know how to ignore it
        params[:user].delete(:current_password)
        @user.update_without_password(params[:user])
    end

    if successfully_updated
        set_flash_message :notice, :updated
         # Sign in the user bypassing validation in case his password changed
         sign_in @user, :bypass => true
         redirect_to after_update_path_for(@user)
    else
         render "edit"
    end

end

private

# check if we need password to update user data
# ie if password or email was changed
# extend this as needed
def needs_password?(user, params)
    user.email != params[:user][:email] ||
    !params[:user][:password].blank?
    #HERE
end

现在,#HERE当我删除帐户时,我还需要输入密码？

Answer 1

您可以form_tag在控制器中创建到操作的重定向。

<%= form_tag url_for(:controller => :users, :action => :destroy), :method => :get do %>
  <%= label_tag(:password, "Enter password before deleting") %>
  <%= password_field_tag :password %>
  <%= submit_tag "Delete User With Confirmation" %>
<% end %>

UsersController 中的操作类似于：

def destroy
    if current_user.authenticate(params[:password])
         #do something
    else
         #do something
    end
end