SOLVED Filename Subject Text vs. Content Subject Text

[Mariano Absatz]

Alright... I look at the code and the bug is quite trivial.

The following patch solves it:

===================================CUT HERE==================================
--- Message.pm.orig     Wed Sep 10 10:27:53 2003
+++ Message.pm  Wed Sep 10 10:29:45 2003
@@ -1923,7 +1923,7 @@
       !$this->{nameinfected} && # They want the tagging & not already tagged
       !$global::MS->{mta}->TextStartsHeader($this, 'Subject:', $contenttag)) 
{
     if (MailScanner::Config::Value('contentprependsubject',$this)) {
-      $global::MS->{mta}->PrependHeader($this, 'Subject:', $nametag, ' ');
+      $global::MS->{mta}->PrependHeader($this, 'Subject:', $contenttag, ' 
');
       $subjectchanged = 1;
     }
   } else {
===================================CUT HERE==================================

Julian, 

would you apply it to the next release?



El 9 Sep 2003 a las 23:43, Ulysees escribió:

> I'm getting the same thing, MS 4.23-11 no SA and any mail being caught with
> a html form is coming up with filename?
> 
> uly
> 
> ----- Original Message ----- 
> From: "Mariano Absatz" <mailscanner at LISTS.COM.AR>
> To: <MAILSCANNER at JISCMAIL.AC.UK>
> Sent: Tuesday, September 09, 2003 10:35 PM
> Subject: [MAILSCANNER] Filename Subject Text vs. Content Subject Text
> 
> 
> Hi,
> 
> I'm using MS 4.23-11 with SA 2.55.
> 
> It seems MS is somehow confusing "Filename Subject Text" "Content Subject
> Text".
> 
> I have the following settings:
> Allow IFrame Tags = no
> Log IFrame Tags = yes
> Allow Form Tags = no
> Allow Object Codebase Tags = no
> Filename Modify Subject = no
> Filename Subject Text = {Nombre de archivo anexo prohibido}
> Content Modify Subject = yes
> Content Subject Text = {Contenido potencialmente peligroso}
> 
> And, when getting a message with IFrame, it added the "Filename Subject
> Text" instead of the "Content Subject Text" I expected.
> 
> Here's the log:
> 
> Sep  5 14:43:51 or MX[4995]: New Batch: Scanning 1 messages, 43452 bytes
> Sep  5 14:43:51 or MX[4995]: Spam Checks: Starting
> Sep  5 14:43:54 or MX[4995]: Virus and Content Scanning: Starting
> Sep  5 14:43:54 or MX[4995]: Filename Checks: Allowing msg-4995-156.html
> (no rule matched)
> Sep  5 14:43:54 or MX[4995]: Filename Checks: Allowing msg-4995-155.txt
> Sep  5 14:43:54 or MX[4995]: Filetype Checks: Allowing msg-4995-155.txt
> Sep  5 14:43:54 or MX[4995]: Filetype Checks: Allowing msg-4995-156.html
> Sep  5 14:43:54 or MX[4995]: HTML IFrame tag found in message 1221617 from
> boletininformar at redinformar.com.ar
> Sep  5 14:43:54 or MX[4995]: Content Checks: Detected HTML-specific
> exploits in 1221617
> Sep  5 14:43:54 or MX[4995]: Content Checks: Found 1 problems
> Sep  5 14:43:54 or MX[4995]: ZM: message 1221617 renamed into 1156463
> Sep  5 14:43:54 or MX[4995]: Silent: Delivered 1 messages containing silent
> viruses
> 
> 
> And the modified was:
> {Nombre de archivo anexo prohibido} RI-Boletín Informar Computación: Año 1 -
>  Número 51 - SEPTIEMBRE 5, 2003
> 
> 
> Are these entries mixed up?
> 
> 
> --
> Mariano Absatz
> El Baby
> ----------------------------------------------------------
> Don't worry about the world coming to an end today.It's already tomorrow in
> Australia.        -- Charles Schulz


--
Mariano Absatz
El Baby
----------------------------------------------------------
I must confess, I was born at a very early age.
      -- Groucho Marx