title: Updated checkbox, when there is no data passed. ROR. What is going on?
body: <p>I constructed a Many-to-Many association between Users and Roles. </p>
  
  <p>When a non-administrator logs in, I have hidden the Edit Role function, using </p>
  
  <p>using the following code:</p>
  
  <p>view/users/edit.html.erb</p>
  
  <pre><code>&lt;%= error_messages_for :user %&gt;
  
  &lt;% form_for @user do |f| -%&gt;
    &lt;p&gt;&lt;label for="login"&gt;Login&lt;/label&gt;&lt;br/&gt;
    &lt;%= f.text_field :login %&gt;&lt;/p&gt;
  
    &lt;p&gt;&lt;label for="email"&gt;Email&lt;/label&gt;&lt;br/&gt;
    &lt;%= f.text_field :email %&gt;&lt;/p&gt;
  
    &lt;p&gt;&lt;label for="password"&gt;Password&lt;/label&gt;&lt;br/&gt;
    &lt;%= f.password_field :password %&gt;&lt;/p&gt;
  
    &lt;p&gt;&lt;label for="password_confirmation"&gt;Confirm Password&lt;/label&gt;&lt;br/&gt;
    &lt;%= f.password_field :password_confirmation %&gt;&lt;/p&gt;
  
    &lt;% if admin? %&gt;
    &lt;% for role in Role.find(:all) %&gt;
   &lt;div&gt;
    &lt;%= check_box_tag "user[role_ids][]", role.id, @user.roles.include?(role) %&gt;
    &lt;%= role.name %&gt;
   &lt;/div&gt;
   &lt;% end %&gt;
   &lt;% else %&gt;
   &lt;% hidden_field :email, :email %&gt;
   &lt;% end %&gt;
  
    &lt;p&gt;&lt;%= submit_tag 'Update' %&gt;&lt;/p&gt;
  &lt;% end %&gt;
  </code></pre>
  
  <p>the terminal output, was what I expected and is as follows:</p>
  
  <pre><code>Processing UsersController#update (for 127.0.0.1 at 2010-01-05 21:28:54) [PUT]
    Parameters: {"commit"=&gt;"Update", "action"=&gt;"update", "_method"=&gt;"put", "authenticity_token"=&gt;"E6qUNM3gS9OmxuAZpmF7FE2Mr/lowznNLMd6ENNT6uk=", "id"=&gt;"5", "controller"=&gt;"users", "user"=&gt;{"password_confirmation"=&gt;"[FILTERED]", "password"=&gt;"[FILTERED]", "login"=&gt;"lesa", "email"=&gt;"lesa@gmail.com"}}
  </code></pre>
  
  <p>However when I was surprised the user lost her rights (prior to her password update her roles: [1,2])</p>
  
  <pre><code>&gt;&gt; user = User.find_by_login("lesa")
  =&gt; #&lt;User id: 5, login: "lesa", email: "lesa@gmail.com", crypted_password: "58026ae120d0686196df3c72c9e3df5da596326d", salt: "f02ef9e00d16f1b9f82dfcc488fdf96bf5aab4a8", created_at: "2009-12-29 15:15:51", updated_at: "2010-01-05 21:28:54", remember_token: nil, remember_token_expires_at: nil&gt;
  &gt;&gt; user.role_ids
  =&gt; []
  &gt;&gt; 
  </code></pre>
  
  <p>In the user model controller I am using:</p>
  
  <pre><code>attr_accessible :login, :email, :password, :password_confirmation, :role_ids
  </code></pre>
  
  <p>How would it be possible for users without the proper rights (role) to NOT update their role_ids? Obviously what I have is seriously flawed. Below is the terminal output of an Administrator correcting Lesa's Rights (role). </p>
  
  <pre><code>Processing UsersController#update (for 127.0.0.1 at 2010-01-05 21:34:01) [PUT]
    Parameters: {"commit"=&gt;"Update", "action"=&gt;"update", "_method"=&gt;"put", "authenticity_token"=&gt;"/yC1s9T8yWZH+eM5fnhPwdeHPCTcT1d8IGoIn+tEd4Q=", "id"=&gt;"5", "controller"=&gt;"users", "user"=&gt;{"password_confirmation"=&gt;"[FILTERED]", "role_ids"=&gt;["2"], "password"=&gt;"[FILTERED]", "login"=&gt;"lesa", "email"=&gt;"lesa@gmail.com"}}
  </code></pre>
  
  <p>User controller code:</p>
  
  <pre><code>class UsersController &lt; ApplicationController
    # Be sure to include AuthenticationSystem in Application Controller instead
  
      #routine that is excecuted before every action in controller "Before_filter
    before_filter :login_required
    require_role "admin", :for =&gt; [:index, :create, :destroy]
  
    def index
      @users = User.find(:all)
    end
  
   def show
    @user = User.find(params[:id])
   end
  
   def destroy
    @user = User.find(params[:id])
    @user.destroy
  
    redirect_to(users_url)
   end
  
   def edit
      @user = User.find(params[:id])
   end
  
   def update
      @user = User.find(params[:id])
  
    params[:user][:role_ids] ||= []
  
    if @user.update_attributes(params[:user])
       flash[:notice] = 'User was successfully updated.'
      redirect_to(user_path(@user))
   else
      render :action =&gt; 'edit'
   end
   end
  
    # render new.rhtml
    def new
    end
  
    def create
      cookies.delete :auth_token
      # protects against session fixation attacks, wreaks havoc with 
      # request forgery protection.
      # uncomment at your own risk
      # reset_session
      @user = User.new(params[:user])
      @user.save
      if @user.errors.empty?
        self.current_user = @user
        redirect_back_or_default('/')
        flash[:notice] = "Thanks for signing up!"
      else
        render :action =&gt; 'new'
      end
    end
  
  end
  </code></pre>