`has_secure_password` is not invalid when assigning empty Strings.

Closes #9535.

With 692b3b6 the `password=` setter does no longer set blank passwords.
This triggered validation errors when assigning empty Strings to `password`
and `password_confirmation`.

This patch only sets the confirmation if it is not `blank?`.

1 files changed, 8 insertions, 2 deletions

diff --git a/activemodel/lib/active_model/secure_password.rb b/activemodel/lib/active_model/secure_password.rb
index 6644b60609..9324a1ad0a 100644
--- a/activemodel/lib/active_model/secure_password.rb
+++ b/activemodel/lib/active_model/secure_password.rb
@@ -48,6 +48,8 @@ module ActiveModel
 
         attr_reader :password
 
+        include InstanceMethodsOnActivation
+
         if options.fetch(:validations, true)
           validates_confirmation_of :password
           validates_presence_of     :password, :on => :create
@@ -55,8 +57,6 @@ module ActiveModel
           before_create { raise "Password digest missing on new record" if password_digest.blank? }
         end
 
-        include InstanceMethodsOnActivation
-
         if respond_to?(:attributes_protected_by_default)
           def self.attributes_protected_by_default #:nodoc:
             super + ['password_digest']
@@ -99,6 +99,12 @@ module ActiveModel
           self.password_digest = BCrypt::Password.create(unencrypted_password, cost: cost)
         end
       end
+
+      def password_confirmation=(unencrypted_password)
+        unless unencrypted_password.blank?
+          @password_confirmation = unencrypted_password
+        end
+      end
     end
   end
 end