vkill'blog

  before_filter :deny_unknownuser, :except => [:new, :create]
  def deny_unknownuser
    permission_denied if !islogin?
  end
  #这里还有一个问题，即 create 后会redirect_to 到 show，show上做权限没必要（个人觉得），所以这里改下 create ，改为提示注册成功后去登陆，不到show，这样就简单了
  def create
    @user = User.new(params[:user])
    respond_to do |format|
      if @user.save
        #flash[:notice] = 'User was successfully created.'
        #format.html { redirect_to(@user) }
        #format.xml  { render :xml => @user, :status => :created, :location => @user }
        #提示创建成功后跳转到登陆页面，auto_redirect为自己写的helper
        format.html { auto_redirect(:sec=>'3',:url=>login_page_path,:msg=>'User was successfully created.') }
        format.xml  { head :ok }
      else
        format.html { render :action => "new" }
        format.xml  { render :xml => @user.errors, :status => :unprocessable_entity }
      end
    end
  end

  before_filter :deny_normaluser, :only => [:new, :create, :index, :destroy]
  before_filter :load_user, :only => [:show, :edit, :update, :destroy]
  def deny_normaluser
    permission_denied if islogin? and !isadmin?
  end
  #load_user，这个的目的是不能让用户去修改和查看别人的信息，当 show edit update 的时候会根据session[:userid] 来User.find
  #使用load_user的时候还要注意一个事项，我们使用load_user来定义@user ，那么show edit update destroy 这四个action 中的@user = User.find(params[:id]) 就都要注释掉了
  def load_user
    if isadmin?
      @user = User.find(params[:id])
    else
      @user = User.find(:first, :conditions=>["name = ?", userid()])
    end
  end