[#4245] Allowing password to nil

lib/devise/models/database_authenticatable.rb

@@ -37,17 +37,18 @@ def self.required_fields(klass)
       # the hashed password.
       def password=(new_password)
         @password = new_password
-        self.encrypted_password = password_digest(@password) if @password.present?
+        self.encrypted_password = password_digest(@password) 
       end
 
       # Verifies whether a password (ie from sign in) is the user password.
       def valid_password?(password)
+        return false if password.blank?
         Devise::Encryptor.compare(self.class, encrypted_password, password)
       end
 
       # Set password and password confirmation to nil
       def clean_up_passwords
-        self.password = self.password_confirmation = nil
+        @password = @password_confirmation = nil
       end
 
       # Update record attributes when :current_password matches, otherwise
@@ -144,6 +145,7 @@ def send_password_change_notification
       # See https://github.com/plataformatec/devise-encryptable for examples
       # of other hashing engines.
       def password_digest(password)
+        return if password.blank?
         Devise::Encryptor.digest(self.class, password)
       end
 

test/models/database_authenticatable_test.rb

@@ -108,9 +108,9 @@ def setup
     assert_nil user.authenticatable_salt
   end
 
-  test 'should not generate a hashed password if password is blank' do
-    assert_blank new_user(password: nil).encrypted_password
-    assert_blank new_user(password: '').encrypted_password
+  test 'should set encrypted password to nil if password is nil' do
+    assert_nil new_user(password: nil).encrypted_password
+    assert_nil new_user(password: '').encrypted_password
   end
 
   test 'should hash password again if password has changed' do
@@ -266,4 +266,11 @@ def setup
       ]
     end
   end
+
+  test 'nil password should be invalid if password is set to nil' do
+    user = User.create(email: "HEllO@example.com", password: "12345678")
+    user.password = nil
+    refute user.valid_password?('12345678')
+    refute user.valid_password?(nil)
+  end
 end