title: Allow admins to edit users details including password
body: <p>I'm building an engine for administration, so I need to have some way to change the user details, including passwords.</p>
  
  <p>Currently my form is complaining about the empty password, when I change other fields. I want to change them without filling the password fields.</p>
  
  <p>One solution would be to "manually" check the parameters and remove the passwords parameters if they are empty, but this looks hackish.</p>
  
  <p>To allow to treat users like resources, so I can execute the CRUD operations, I add it to the <code>routes.rb</code>:</p>
  
  <pre><code>Admin::Engine.routes.draw do
    resources :users
  end
  </code></pre>
  
  <p><strong>users_controller.rb</strong></p>
  
  <pre><code>require_dependency "admin/application_controller"
  
  module Admin
    class UsersController &lt; ApplicationController
      before_action :set_user, only: [:show, :edit, :update, :destroy]
  
      # GET /users
      def index
        @users = User.all
      end
  
      # GET /users/1
      def show
      end
  
      # GET /users/new
      def new
        @user = User.new
      end
  
      # GET /users/1/edit
      def edit
      end
  
      # POST /users
      def create
        @user = User.new(user_params)
  
        if @user.save
          redirect_to @user, notice: 'User was successfully created.'
        else
          render :new
        end
      end
  
      # PATCH/PUT /users/1
      def update
        if @user.update(user_params)
          if(@user == current_user and @user.admin_locked)
            redirect_to @user, notice: 'User was successfully updated, but you locked yourself.'
          else
            redirect_to @user, notice: 'User was successfully updated.'
          end
        else
          render :edit
        end
      end
  
      # DELETE /users/1
      def destroy
        @user.destroy
        redirect_to users_url, notice: 'User was successfully destroyed.'
      end
  
      private
      # Use callbacks to share common setup or constraints between actions.
      def set_user
        @user = User.find(params[:id])
      end
  
      # Only allow a trusted parameter "white list" through.
      def user_params
        params.require(:user).permit(:email, :role, :password, :password_confirmation, :reset_password_token, :admin_locked)
      end
    end
  end
  </code></pre>
  
  <p><strong>_form.html.erb</strong></p>
  
  <pre><code>&lt;%= form_for(@user) do |f| %&gt;
    &lt;% if @user.errors.any? %&gt;
    &lt;div id="error_explanation"&gt;
    &lt;h2&gt;&lt;%= pluralize(@user.errors.count, "error") %&gt; prohibited this user from being saved:&lt;/h2&gt;
  
    &lt;ul&gt;
      &lt;% @user.errors.full_messages.each do |message| %&gt;
        &lt;li&gt;&lt;%= message %&gt;&lt;/li&gt;
    &lt;% end %&gt;
    &lt;/ul&gt;
  &lt;/div&gt;
    &lt;% end %&gt;
  
  &lt;section&gt;
    &lt;div class="form-group"&gt;
      &lt;%= f.label :email %&gt;&lt;br&gt;
      &lt;%= f.text_field :email, required: true%&gt;
    &lt;/div&gt;
  
    &lt;div class="form-group"&gt;
      &lt;%= f.label :role %&gt;&lt;br&gt;
      &lt;%= f.select :role, User.roles.keys.to_a.map {|role| [role.humanize, role]} %&gt;
    &lt;/div&gt;
  
    &lt;div class="form-group"&gt;
      &lt;%= f.label :password, "New password" %&gt;
      &lt;%= f.password_field :password, autofocus: true, autocomplete: "off", class: "form-control" %&gt;
    &lt;/div&gt;
  
    &lt;div class="form-group"&gt;
      &lt;%= f.label :password_confirmation, "Confirm new password" %&gt;
      &lt;%= f.password_field :password_confirmation, autocomplete: "off", class: "form-control"%&gt;
    &lt;/div&gt;
  
    &lt;div class="form-group"&gt;
      &lt;%= f.label :admin_locked,  'Locked'%&gt;&lt;br&gt;
      &lt;%= f.check_box :admin_locked %&gt;
    &lt;/div&gt;
  &lt;/section&gt;
  
  &lt;div class="actions"&gt;
    &lt;%= f.submit %&gt;
  &lt;/div&gt;
  &lt;% end %&gt;
  </code></pre>
  
  <p><strong>user.rb</strong></p>
  
  <pre><code>module Admin
    class User &lt; ActiveRecord::Base
      validates :password, length: { in: 6..128 }, on: :update, allow_blank: true
    end
  end
  </code></pre>
  
  <p><strong>logs:</strong></p>
  
  <pre><code>Started PATCH "/admin/users/3" for 127.0.0.1 at 2015-02-23 16:16:15 +0000
  Processing by Admin::UsersController#update as HTML
    Parameters: {"utf8"=&gt;"✓", "authenticity_token"=&gt;"OZC69AMbTAfp361HKHTYHUKnEvAI+2zf7z0k08S4a/mxHOV+IZ0r3uFxrSX2E6Euj10ZlXLK1BzKB8dsGIAEnA==", "user"=&gt;{"email"=&gt;"ze@ze.com", "role"=&gt;"admin", "password"=&gt;"[FILTERED]", "password_confirmation"=&gt;"[FILTERED]", "admin_locked"=&gt;"0"}, "commit"=&gt;"Update User", "id"=&gt;"3"}
    User Load (0.4ms)  SELECT  "users".* FROM "users" WHERE "users"."id" = $1 LIMIT 1  [["id", 3]]
     (0.6ms)  BEGIN
     (0.2ms)  ROLLBACK
    Rendered admin/app/views/admin/users/_form.html.erb (3.9ms)
    Rendered admin/app/views/admin/users/edit.html.erb within layouts/admin/application (5.9ms)
    Rendered admin/app/views/layouts/admin/_navigation_links.html.erb (0.3ms)
    Rendered admin/app/views/layouts/admin/_navigation.html.erb (2.2ms)
    Rendered admin/app/views/layouts/admin/_messages.html.erb (0.3ms)
  Completed 200 OK in 55ms (Views: 21.0ms | ActiveRecord: 3.6ms)
  </code></pre>
  
  <p>Versions: Rails 4.2, devise 3.4.1</p>
  
  <p><strong>NOTE for close reviews:</strong> this is not a typical Rails app, it's happening in a Rails Engine. If you vote to close please understand the difference.</p>