<>strong>users_controller.rb

class UsersController < ApplicationController
  before_filter :authenticate, :only => [:index, :edit, :update, :destroy]
  before_filter :correct_user, :only => [:edit, :update]
  before_filter :admin_user,   :only => :destroy

  def show
    @user = User.find(params[:id])
    @microposts = @user.microposts.paginate(:page => params[:page])
    @title = @user.name
    @admins = User.where(:admin => "t")
  end

  def new
    @user = User.new
    @title = "Sign up"
  end

  def create
    @user = User.new(params[:user])
    if @user.save
      sign_in @user
      flash[:success] = "Welcome to University Sports!"
      redirect_to @user
    else
      @title = "Sign up"
      render  new 
    end
  end

  def edit
    @title = "Edit user"
  end

  def update
    @user = User.find(params[:id])
    if @user.update_attributes(params[:user])
      flash[:success] = "Profile updated."
      redirect_to @user
    else
      @title = "Edit user"
      render  edit 
    end
  end

  def index
    @users = User.paginate(:page => params[:page])
  end

  #def admins
  #  @users = User.admins
  #  render "users/index"
  #end

  def admins
    @admins=User.where(:admin => "t")
  end

  def destroy
    User.find(params[:id]).destroy
    flash[:success] = "User destroyed."
    redirect_to users_path
  end

  def following
    @title = "Following"
    @user = User.find(params[:id])
    @users = @user.following.paginate(:page => params[:page])
    render  show_follow 
  end

  def followers
    @title = "Followers"
    @user = User.find(params[:id])
    @users = @user.followers.paginate(:page => params[:page])
    render  show_follow 
  end  

  private

    def authenticate
      deny_access unless signed_in?
    end

    def correct_user
      @user = User.find(params[:id])
      redirect_to(root_path) unless current_user?(@user)
    end

    def admin_user
      redirect_to(root_path) unless current_user.admin?
    end

end

<>Routes>。

FinalProject::Application.routes.draw do
  get "club/new"

  resources :users do
    member do
      get :following, :followers
    end
  end

  resources :users do
    collection do
      get :admins
    end
  end

  resources :sessions, :only => [:new, :create, :destroy]
  resources :microposts, :only => [:create, :destroy]
  resources :relationships, :only => [:create, :destroy]
  get "sessions/new"

  match  /signup ,  :to =>  users#new 
  match  /signin ,  :to =>  sessions#new 
  match  /signout , :to =>  sessions#destroy 

  match  /sign_up , :to =>  pages#sign_up 

  root :to =>  pages#home 

  resources :users
  match  /signup ,  :to =>  users#new 

end

<>strong>user.rb

class User < ActiveRecord::Base
    attr_accessor :password
    attr_accessible :name, :email, :password, :password_confirmation

    has_many :microposts, :dependent => :destroy
    has_many :relationships, :foreign_key => "follower_id", :dependent => :destroy
    has_many :following, :through => :relationships, :source => :followed   
    has_many :reverse_relationships, :foreign_key => "followed_id", :class_name => "Relationship", :dependent => :destroy
    has_many :followers, :through => :reverse_relationships, :source => :follower

    email_regex = /A[w+-.]+@[a-zd-.]+.[a-z]+z/i

    validates :name,    :presence   => true, :length  => { :maximum => 50 }
    validates :email,   :presence   => true, :format  => { :with => email_regex }, :uniqueness => { :case_sensitive => false }

    scope :admins, where(:admin => true)

    # Automatically create the virtual attribute  password_confirmation .
    validates :password, :presence  => true, :confirmation  => true, :length  => { :within => 6..40 }
        before_save :encrypt_password

  def has_password?(submitted_password)
    encrypted_password == encrypt(submitted_password)
  end

  def self.authenticate(email, submitted_password)
    user = find_by_email(email)
    return nil  if user.nil?
    return user if user.has_password?(submitted_password)
  end

  def self.authenticate_with_salt(id, cookie_salt)
    user = find_by_id(id)
    (user && user.salt == cookie_salt) ? user : nil
  end

  def following?(followed)
    relationships.find_by_followed_id(followed)
  end

  def follow!(followed)
    relationships.create!(:followed_id => followed.id)
  end

  def unfollow!(followed)
    relationships.find_by_followed_id(followed).destroy
  end

  def feed
    Micropost.from_users_followed_by(self)
  end

  private

    def encrypt_password
      self.salt = make_salt unless has_password?(password)
      self.encrypted_password = encrypt(password)
    end

    def encrypt(string)
      secure_hash("#{salt}--#{string}")
    end

    def make_salt
      secure_hash("#{Time.now.utc}--#{password}")
    end

    def secure_hash(string)
      Digest::SHA2.hexdigest(string)
    end



end

admins.html.erb

<ul class="admins">
  <%= render @admins %>
</ul>