Hi,
I figured it out. Quoting/escaping is your friend.
rawbody LOCAL_OBFUS_SPAN //i
score LOCAL_OBFUS_SPAN 0.5
Regards,
Nicki
On Tue, Jun 14, 2005 at 02:32:11PM +0200, Nicki de Wet wrote:
> body LOCAL_OBFUS_SPAN //i
>
> The email below does not match this rule, although I don't know why. Does SA
> stop executing tests after a certain point, or when certain tests are
> positive?
Body rules are run against the decoded +
Thanks, I also saw it in the docs now. I've changed it, and will see if the
problem persists.
Regards,
Nicki de Wet
- Original Message -
From: "Matt Kettler" <[EMAIL PROTECTED]>
To: "Nicki de Wet" <[EMAIL PROTECTED]>;
Sent: Tuesday, June 14, 2005
At 08:32 AM 6/14/2005, Nicki de Wet wrote:
I have the following test in local.cf:
body LOCAL_OBFUS_SPAN //i
score LOCAL_OBFUS_SPAN 0.5
That's an HTML tag, you have to use rawbody, not body. body rules are run
after all HTML tags are removed from the message.
