Refactored code for updating user password, email and other info
A few obvious things would be:

1) You shouldn't include current_email and current_password in the sanitized_params since you don't want to update these only validate them.

2) Similarly for new_email and new_password, you have aleady updated these manually

3) So really you aren't updating anything else currently.

4) If your first two tests fail you render a json error but don't stop processing so the last if clause will still execute and you will get a double render error. You should probably test all your conditions before executing any code.

I would consider moving the update logic into methods on the User model (update_email, #update_password that do the validation for you.