Daniel Lemke wrote:
> Hmm, I've just noticed that my rule is working fine for simple text
> messages, but is also been triggered when checking mails containing html
> (http://pastebin.com/xB7SKnFV).
>
> rawbody T__SHORT_MAIL /\A.{0,150}\z/s
>
> -D reports:
> Jun 28 13:32:40.961 [4200] dbg: rules: ran rawbody rule T__SHORT_MAIL
> ======> got hit: "
>
> Any hints on this?
The best idea was suggested by someone else. Instead of trying to match
a short segment, do a negative match on a longer one.
rawbody T__LONG_MAIL /.{151}/s
meta T_SHORT_MAIL !T__LONG_MAIL
Once you've tested the rule, you can remove the "T" from the T_LONG_MAIL
rule so that it becomes a subrule and will not be scored or show in the
reports.
--
Bowie
