Matt Kettler wrote:
At 06:27 AM 9/8/2005, Arthur Kerpician wrote:
Hi,
I'm pretty new in writing custom SA rules and I was wondering how can
I check if a message has an attachement with a specific extension (eg
.pps). What I'm trying to do is to tag as spam messages that have
.pps attachements and are coming from one e-mail address. I don't
want to block all .pps attachements which was easy with qmail-scanner.
AFAIK this isn't all that easy in SA versions under 3.1. You wind up
having to write a "full" rule to look for the mime boundary, then have
a regex look for the filename within that. Fairly advanced rule
writing required.
Realistically it will be significantly easier to do this in
qmail-scanner. Blocking a specific filename is just as easy as
blocking an extension. Just edit your quarantine-attachments.txt.
There's examples in there of blocking by complete filename.
That's the problem, I'm having just this guy who's sending stupid pps
files. I don't want to block all pps files and I don't want to block
this guy (he's kinda important to my client but sometimes he acts stupid
by sending that crap).
BTW I'm using SA 3.0.2.
