blocked conent problem in 4.25-14

[Daniel Bird]

Daniel Bird wrote:

> This is a snippet from MailScanner.conf
>
> Allow IFrame Tags = /etc/MailScanner/rules/iframe.tags.rules
> Log IFrame Tags = yes
> Allow Form Tags =/etc/MailScanner/rules/form.tags.rules
> Allow Object Codebase Tags = /etc/MailScanner/rules/codebase.tags.rules
> Convert Dangerous HTML To Text = yes
> Convert HTML To Text = no
>
> /etc/MailScanner/rules/iframe.tags.rules contains:
> From:      *@nature.com         yes
> From:      *@info.nature.com    yes
> FromTo:      default            no
>
> so according to the comments we should be hitting the last option below
> for messages from nature.com
> :
> # Allow...Tags    Convert Danger...    Action Taken on HTML Message
> # ============    =================    ============================
> #    no              no                Blocked
> #    no              yes               Blocked
> #    disarm          no                Specified HTML tags disarmed
> #    disarm          yes               Specified HTML tags disarmed
> #    yes             no                Nothing, allowed to pass
> *#    yes             yes               All HTML tags stripped**
> *
>
> But our users are still getting Blocked content reports on email from
> nature.com containing I-Frame tags.
>
> ie:
>
> At Thu Dec  4 08:32:22 2003 the content filters said:
>   MailScanner: Found dangerous IFrame tag in HTML message
>
>
> This worked previously on 4-22 (upgraded to 4-25-14 yesterday)
> Anyone have any idea's where I'm going wrong?

Sorry to reply to my own posting, but I think I've figured it.
It looks like nature.com has changed the way they send mail shots (or
this a new one which we haven't seen before). The envelope address was
not the same as listed in the email (as was previously). I've added the
new address to the rules file, so all should be well.

Regards



--
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.