There are numerous questions (ie: [here](https://stackoverflow.com/questions/32808571/unpermitted-parameters-current-password-rails-4-devise) and [here](https://stackoverflow.com/questions/17384289/unpermitted-parameters-adding-new-fields-to-devise-in-rails-4-0)) that address this issue (and were useful to others with the same problem), but none of them have worked yet for me.

Using Rails 5.0.0 and Devise 4.2, ultimately I am trying to allow admins to edit other users, and to allow regular users to edit their own accounts. [This](https://stackoverflow.com/questions/4081744/devise-form-within-a-different-controller) required [a few modifications](https://stackoverflow.com/questions/35583473/edit-other-user-as-admin-in-devise-ruby-on-rails), since by default Devise doesn't let the logged-in user edit other users.

The form in the `users/:id/edit` view now populates with the correct user, BUT the update fails, with `Unpermitted parameter: current_password` in the logs. I believe that I need to whitelist `:current_password`, but none of the suggestions accomplish this for me.

**routes.rb**

```
devise_for :users, controllers: {registrations: 'registrations'}, path_prefix: 'my'
resources :users

```

(The `path_prefix` "my" was suggested as a way to avoid route conflicts between Devise and the `:users` resource.)

**registrations\_controller.rb**

```
class RegistrationsController < Devise::RegistrationsController
  before_action :configure_permitted_parameters, if: :devise_controller?

  ...

  protected

  def configure_permitted_parameters
    devise_parameter_sanitizer.for(:sign_up) do |u|
      u.permit(:password, :password_confirmation)
    end

    devise_parameter_sanitizer.for(:account_update) do |u|
      u.permit(:password, :password_confirmation, :current_password)
    end
  end
end

```

**users\_controller.rb**

```
class UsersController < ApplicationController
  before_action :set_user, only: [:edit, :show, :update, :destroy]

  ...

  def edit
  end

  def update
    @user = User.find(params[:id])
    if @user.update(user_params)
      redirect_to cohorts_path
    else
      render 'edit'
    end
  end

  private

  def set_user
    @user = User.find(params[:id])
  end

  def user_params
    params.require(:user).permit(:first_name, :last_name, :email, :password, :password_confirmation, :roles, :nickname, :location, :headshot, :goals)

  end
end

```

You might be wondering why I didn't add `:current_password` to the `user_params`. Doing so results in an [unknown attribute 'current\_password' for User. error.](https://stackoverflow.com/questions/12142374/railstutorial-org-chapter-6-unknown-attribute-password) (Adding the suggested `attr_accessor` didn't help.)

This is the first time I've needed to customize Devise. Any help is appreciated!