Post model

class Post < ActiveRecord::Base

  validates_presence_of :title, :body

  has_many :comments
  has_many :objects
  belongs_to :user
end
------------------

user model
class User < ActiveRecord::Base

  has_many :comments
  has_many :posts

  validates_presence_of :name
  validates_uniqueness_of :name

  attr_accessor :password_confirmation
  validates_confirmation_of :password

  validate :password_non_blank

  validates_format_of :email, :with => /\A([^@\s]+)@((?:[-a-z0-9]+\.)+[a-z]{2,})\Z/i
  validates_uniqueness_of :email, :case_sensitive => false

  def self.authenticate(name, password)

    user = self.find_by_name(name)
    if user
      expected_password = encrypted_password(password, user.salt)
      if user.hashed_password != expected_password
        user = nil
      end
    end
    user
  end
  # 'password' is a virtual attribute
  def password
    @password
  end



  def password=(pwd)
    @password = pwd
    return if pwd.blank?
    create_new_salt
    self.hashed_password = User.encrypted_password(self.password, self.salt)
  end

#def email=(eml)
 # @email = eml
 # return if eml.blank?
#end

  private

  def password_non_blank
    errors.add(:password, "Missing password") if hashed_password.blank?
  end

  #def email_non_blank
   # errors.add(:email, "Missing email") if email.blank?
  #end

  def create_new_salt
    self.salt = self.object_id.to_s + rand.to_s
  end

  def self.encrypted_password(password, salt)
    string_to_hash = password + "wibble" + salt
    Digest::SHA1.hexdigest(string_to_hash)
  end
end
---------------

posts controller

class PostsController < ApplicationController
before_filter :authorize, :except => :index
  # GET /posts
  # GET /posts.xml
  def index
    @posts = Post.find(:all)

      respond_to do |format|
      format.html # index.html.erb
      format.xml  { render :xml => @posts }
    end
  end

  # GET /posts/1
  # GET /posts/1.xml
  def show
    @post = Post.find(params[:id])
    @post_comments = @post.comments.collect
    flash[:post_id] =@post.id

  end

  # GET /posts/new
  # GET /posts/new.xml

  def new
    @post = Post.new
    @post.user_id = session[:user_id]
      respond_to do |format|
      format.html # new.html.erb
      format.xml  { render :xml => @post }
    end
  end


  # GET /posts/1/edit
  #def edit
   # @post = Post.find(params[:id])
  #end

  # POST /posts
  # POST /posts.xml
  def create

    @post = Post.new(params[:post])

     respond_to do |format|
      if @post.save
        flash[:notice] = 'Post was successfully created.'
        format.html { redirect_to(@post) }
        format.xml  { render :xml => @post, :status => :created, :location => @post }
      else
        format.html { render :action => "new" }
        format.xml  { render :xml => @post.errors, :status => :unprocessable_entity }
      end
    end
  end

  # PUT /posts/1
  # PUT /posts/1.xml
  #def update
  # @post = Post.find(params[:id])

   # respond_to do |format|
    # if @post.update_attributes(params[:post])
     #   flash[:notice] = 'Post was successfully updated.'
      #  format.html { redirect_to(@post) }
       # format.xml  { head :ok }
      #else
       #format.html { render :action => "edit" }
      #format.xml  { render :xml => @post.errors, :status => :unprocessable_entity }
      #end
    #end
  #end

  # DELETE /posts/1
  # DELETE /posts/1.xml
  def destroy
    @post = Post.find(params[:id])
    @post.destroy

    respond_to do |format|
      format.html { redirect_to(posts_url) }
      format.xml  { head :ok }
    end
  end

 # Adding a comment
   # Adding a comment
  # Adding a comment
  def post_comment

      @comment = Comment.new(
      "post_id" => flash[:post_id],
      "created_at" => Time.now,
        "user_id" => session[:user_id],
      "comment" => params[:comment]['comment']
                       )
      if @comment.save
        flash[:notice] = 'Comment was successfully added.'
      else
        flash[:error] = 'Comment cant be blank'
       end
     redirect_to :action => 'show', :id => flash[:post_id]

  end

   protected
  def authorize
    unless User.find_by_id(session[:user_id])
      session[:original_uri] = request.request_uri
      flash[:notice] = "You need to log in first"
      redirect_to :controller => 'admin/login/login'
    end
  end

end


------------------

posts /index view

<h1> Web Aesthetics Forum </h1><br/>
  <div style="color: #008080; font-size: 10pt">
<% for post in @posts.reverse %>
 <h2><%= post.title %></h2>
 <h3><%= post.user.name %>, at <%= post.created_at.strftime("%B %d, %Y at %I:%M %p") %></h3>
 <p><%= post.body %></p>
 <small>
   <%= link_to "Show/Make comments",
     :action => "show",
     :id => post %>

 </small>
<hr>
<% end %>
<br />
<%= link_to 'New post', new_post_path %>