At 06:27 AM 9/8/2005, Arthur Kerpician wrote:
Hi,
I'm pretty new in writing custom SA rules and I was wondering how can I
check if a message has an attachement with a specific extension (eg .pps).
What I'm trying to do is to tag as spam messages that have .pps
attachements and are coming from one e-mail address. I don't want to block
all .pps attachements which was easy with qmail-scanner.
AFAIK this isn't all that easy in SA versions under 3.1. You wind up having
to write a "full" rule to look for the mime boundary, then have a regex
look for the filename within that. Fairly advanced rule writing required.
Realistically it will be significantly easier to do this in qmail-scanner.
Blocking a specific filename is just as easy as blocking an extension. Just
edit your quarantine-attachments.txt. There's examples in there of blocking
by complete filename.
