Make Rails wait for form submission before continuing - ruby-on-rails

Question

I have the following form and controller.
<%= form_tag do %>
<div>
<%= label_tag :Old %>
<%= password_field_tag :old_password %>
</div>
<div>
<%= label_tag :New %>
<%= password_field_tag :new_password %>
</div>
<div>
<%= label_tag :Confirm %>
<%= password_field_tag :confirm_password %>
</div>
<div>
<%= submit_tag "Update" %>
</div>
<% end %>
and the controller:
def change
#user = current_user
#op = params[:old_password]
#np = params[:new_password]
#cp = params[:confirm_password]
if #np == #cp
#user.update_with_password(:password => #np, :current_password=>#op)
if #user.save
flash[:notice] = "Password Successfully Changed"
redirect_to home_path
end
else
#user.errors.add("Incorrect confirmation")
end
end
This is all tied to 'password/change' in the config/routes.rb
The problem is that when I go to /password/change I immediately an redirected to home and receive the "password successfully changed" flash notice. What I take from it is that it is not requiring me to click the submit button in order to pass the parameters. How do I make it so that it waits for the submission of the form before continuing through the controller?

Answer 1

The problem is that you need 2 separate methods. One to show the view and one to handle the form post.
Right now the "change" method in your password_controller is handling the form post so you need a method like "index" to show the form
def index
#move your form to /views/password/index.html.erb or specifically render your 'change' view
end
Then in your markup add the action to your form
<%= form_tag('/password/change') do %>
…
Then in your controller you can specify POST only for the change method
class PasswordController < ApplicationController
verify :method => :post, :only => :change
…
UPDATE
Instead of using the verify method (removed in rails 3) you should either set up your route to be restful (Rails Routing from the Outside In) or you can create a specific route for changing the password like so:
match 'password/change' => 'password#change', :via => :post

Answer 2

The best practice will be to separate these two things into different controller methods. One should be used to simply display the view, while the other should be used to handle the POST request. However, if you're dead set on doing it this way, I believe a solution like this will work:
def change
#user = current_user
#op = params[:old_password]
#np = params[:new_password]
#cp = params[:confirm_password]
if #np && #np == #cp # This checks to see if params[:new_password] is nil
#user.update_with_password(:password => #np, :current_password=>#op)
I'd strongly suggest you separate it out though.

Answer 3

When you render password/change from the browser, params is nil, so #np == #cp always evaluates to TRUE, executes the update, saves, and does the redirect — in fact, if you check I would bet the user's password is being set to nil.
You need to make sure the params are not empty before attempting the update.
Does that help point you in the right direction?
side note: from a code readability standpoint I might recommend just using the variables inline, instead of the instance vars, but that's just my opinion :)