Here I have given details for how to send shipping rates and calculate shipping charges to paypal.

Paypal’s purchase method requires 3 arguments – money,credit card and options.

money = “YOUR PRODUCT PRICE”

credit_card = ActiveMerchant::Billing::CreditCard.new(

:type => ‘visa’,

:number => ’4242424242424242′,

:month => 8,

:year => 2009,

:first_name => ‘Bob’,

:last_name  => ‘Bobsen’,

:verification_value => ’123′

)

options = {

:ip =>  request.remote_ip,

:shipping =>YOUR SHIPPING RATE*100,

:handling =>YOUR HANDLING RATE*100,

:subtotal =>YOUR PRODUCT PRICE* 100,

:tax =>YOUR TAX RATE*100,
:billing_address => {
:name     => params[:billing_firstname]+params[:billing_lastname],
:address1 =>params[:billing_address],
:city     => params[:billing_city],
:state    => params[:billing_state],
:country  => params[:billing_country],
:zip      => params[:billing_zip]
},

:shipping_address => {
:name     => params[:shipping_firstname]+params[:shipping_lastname],
:address1 =>params[:shipping_address],
:city     => params[:shipping_city],
:state    => params[:shipping_state],
:country  => params[:shipping_country],
:zip      => params[:shipping_zip]
}

}

response = creditcard_gateway.purchase(((YOUR PRODUCT PRICE)* 100)+(YOUR SHIPPING RATE*100), credit_card, purchase_options)

For calculating shipping charges,paypal requires all the 4 inputs [:subtotal, :shipping, :handling, :tax] to be passed in options hash.

2.3.4 contains fixes for two security issues

i) XSS Vulnerability in Ruby on Rails

There is a vulnerability in the escaping code for the form helpers in Ruby on Rails. Attackers who can inject deliberately malformed unicode strings into the form helpers can defeat the escaping checks and inject arbitrary HTML.

Impact

Due to the way that most databases either don’t accept or actively cleanse malformed unicode strings this vulnerability is most likely to be exploited by non-persistent attacks however persistent attacks may still be possible in some configurations.

http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails

ii) Timing Weakness in Ruby on Rails

There is a weakness in the code Ruby on Rails uses to verify message digests in the cookie store. Because it uses a non-constant time algorithm to verify the signatures an attacker may be able to determine when a forged signature is partially correct. By repeating this process they may be able to successfully forge a digest.

Impact

Due to issues like network latency, non-deterministic GC runs and other issues it is unlikely that this attack could be exploited in the wild within a reasonable timeframe.

http://weblog.rubyonrails.org/2009/9/4/timing-weakness-in-ruby-on-rails

Part I – http://www.liverail.net/articles/2007/6/29/tutorial-on-developing-a-facebook-platform-application-with-ruby-on-rails

Part II – http://www.liverail.net/articles/2007/7/16/continuing-facebook-applications-with-ruby-on-rails

Reference URL’s :

http://burm.net/2008/10/17/ruby-on-rails-polymorphic-paperclip-plugin-tutorial/

http://thoughtbot.com/projects/paperclip

http://burm.net/2008/10/07/the-ruby-on-rails-paperclip-plugin-tutorial-easy-image-attachments/

So, Case statement has been used for providing two different URL’s for two environments as follows:

case RAILS_ENV
when “development“
@body[:url]=”http://localhost:3000/account/login/”
when “production“
@body[:url]=”http://siteurl.com/account/login/”
end

Two solutions :

Solution 1)

@body[:url]=request.referer.gsub(request.request_uri,”")+”/account/login”

solution 2)

@body[:url]=”http://”+request.env['HTTP_HOST']+”/account/login/”

 In controller :

The ‘request’ should be passed as an argument to the calling method as below.

PostNotifier.deliver_post_send(current_user,params[:email],@post,post_id,categoryname,subcategoryname,request)