set resource attributes in update action and authorize after set - closes #141

lib/cancan/controller_resource.rb

@@ -63,7 +63,7 @@ module CanCan
       if !parent? && new_actions.include?(@params[:action].to_sym)
         build_resource
       elsif id_param || @options[:singleton]
-        find_resource
+        find_and_update_resource
       end
     end
 
@@ -94,6 +94,15 @@ module CanCan
       end
     end
 
+    def find_and_update_resource
+      resource = find_resource
+      if @params[name]
+        @controller.authorize!(authorization_action, resource) if @options[:authorize]
+        resource.attributes = @params[name]
+      end
+      resource
+    end
+
     def find_resource
       if @options[:singleton] && parent_resource.respond_to?(name)
         parent_resource.send(name)