Disarmed Content quarantine

[Rabellino Sergio]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Peter Bonivart wrote:

> Rabellino Sergio wrote:
>
>> Dear list,
>>  i cannot figure out if a "DISARMED CONTENT" can be quarantined.
>> The original email is changed, so if an user (or better the law) 
>> wants the original message delivered later, I'vent a copy.
>>
>> How could this be done ?
>
>
> Only blocked mail will be quarantined. If you set the content filters 
> to yes or disarm they are still sent. You can use the archive function 
> though.
>
Ok, I've figured out how to modify this behaviour, in attachments my 
patches.

Add a new config switch into Mailscanner.conf

# Do you want to store copies of the modified messages?
Quarantine Modified Body = yes

Then changed lib/Mailscanner/ConfigDefs.pl, 
lib/MailScanner/MessageBatch.pm and bin/Mailscanner to catch if a 
message had it's body
modified in any way (disarming  or other checks) and store it in it's 
untouched form.

P.s. I've not understood completely how to define a new conf variable, 
so my 'method' must be confirmed if it's correct.

Bye.

-- 
Dott. Mag. Sergio Rabellino 

 Technical Staff
 Department of Computer Science
 University of Torino (Italy)

http://www.di.unito.it/~rabser
Tel. +39-0116706701
Fax. +39-011751603


------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 2: "Attached Text" ]

487d486
< QuarantineModifiedBody	1	no	0	yes	1

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 3: "Attached Text" ]

628,630d627
<     # Quarantine all the disarmed attachments
<     $batch->QuarantineModifiedBody();
< 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

    [ Part 4: "Attached Text" ]

625,627d624
< # Store all the disarmed files in the quarantine if they want me to.
< # Quarantine decision has to be done on a per-message basis.
< sub QuarantineModifiedBody {
629,641d625
<   my $this = shift;
< 
<   my($id, $message);
< 
<   while(($id, $message) = each %{$this->{messages}}) {
<     next unless $message->{bodymodified};
<     next if MailScanner::Config::Value('quarantinemodifiedbody', $message) !~ /1/;
< 
<     $global::MS->{quar}->StoreInfections($message);
<     MailScanner::Log::InfoLog("Quarantining modified message for = " . $id . " bodymodified is " . $message->{bodymodified});
<   }
< }
< 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!