Merge pull request #9545 from senny/9535_secure_password_blank

`has_secure_password` is not invalid when assigning empty Strings

2 files changed, 13 insertions, 3 deletions

diff --git a/activemodel/lib/active_model/secure_password.rb b/activemodel/lib/active_model/secure_password.rb
index 6644b60609..9324a1ad0a 100644
--- a/activemodel/lib/active_model/secure_password.rb
+++ b/activemodel/lib/active_model/secure_password.rb
@@ -48,6 +48,8 @@ module ActiveModel
 
         attr_reader :password
 
+        include InstanceMethodsOnActivation
+
         if options.fetch(:validations, true)
           validates_confirmation_of :password
           validates_presence_of     :password, :on => :create
@@ -55,8 +57,6 @@ module ActiveModel
           before_create { raise "Password digest missing on new record" if password_digest.blank? }
         end
 
-        include InstanceMethodsOnActivation
-
         if respond_to?(:attributes_protected_by_default)
           def self.attributes_protected_by_default #:nodoc:
             super + ['password_digest']
@@ -99,6 +99,12 @@ module ActiveModel
           self.password_digest = BCrypt::Password.create(unencrypted_password, cost: cost)
         end
       end
+
+      def password_confirmation=(unencrypted_password)
+        unless unencrypted_password.blank?
+          @password_confirmation = unencrypted_password
+        end
+      end
     end
   end
 end
diff --git a/activemodel/lib/active_model/validations/confirmation.rb b/activemodel/lib/active_model/validations/confirmation.rb
index 3a3abce364..d14fb4dc53 100644
--- a/activemodel/lib/active_model/validations/confirmation.rb
+++ b/activemodel/lib/active_model/validations/confirmation.rb
@@ -10,9 +10,13 @@ module ActiveModel
       end
 
       def setup(klass)
-        klass.send(:attr_accessor, *attributes.map do |attribute|
+        klass.send(:attr_reader, *attributes.map do |attribute|
           :"#{attribute}_confirmation" unless klass.method_defined?(:"#{attribute}_confirmation")
         end.compact)
+
+        klass.send(:attr_writer, *attributes.map do |attribute|
+          :"#{attribute}_confirmation" unless klass.method_defined?(:"#{attribute}_confirmation=")
+        end.compact)
       end
     end