view_other_user_home_page.rb

# note: this code could be tightened up a lot, 
# but the concept should be fairly clear
class HomePageController < ApplicationController
  # this ensures 'current_user' is populated with the logged in user
  before_filter :login_required

  def index
    @user  = current_user
    @lists = @user.lists
    @other_things_the_user_owns = @user.other_things_the_user_owns
  end
  
  # terrible name
  def alternate_user_home
    fetch_user_or_redirect
    @lists = @user.lists
    @other_things_the_user_owns = @user.other_things_the_user_owns
    render :action => 'index'
  end
  
  # 'private' methods are not routable so no one can access them through a URL
  private
  
  def fetch_user_or_redirect
    @user = User.find_by_login(params[:login])
    
    # send them on their way if params[:login] was nil or
    # we couldn't find a matching user or they shouldn't
    # have access to this user's home page
    # 
    # allowed_to_view_home_page_for(@user) needs to be implemented
    unless @user && current_user.allowed_to_view_home_page_for(@user) 
      flash[:error] = 'Fail!'
      redirect_to(whatever_path)
    end
  end
end