Disarmed Content quarantine

[Rabellino Sergio]

Julian Field wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Forgive me for sounding thick, but...
>
>What were you trying to achieve? Saving the original or saving a  
>tweaked copy? If saving a tweaked copy, why?
>
>  
>
I've checked the qf/df files, and the message appear as the original, 
not the modified version.
So I believe that i'm saving the original copy, i'm wrong ?

>On 23 Aug 2005, at 13:47, Rabellino Sergio wrote:
>
>  
>
>>Peter Bonivart wrote:
>>
>>
>>    
>>
>>>Rabellino Sergio wrote:
>>>
>>>
>>>      
>>>
>>>>Dear list,
>>>> i cannot figure out if a "DISARMED CONTENT" can be quarantined.
>>>>The original email is changed, so if an user (or better the law)  
>>>>wants the original message delivered later, I'vent a copy.
>>>>
>>>>How could this be done ?
>>>>
>>>>        
>>>>
>>>Only blocked mail will be quarantined. If you set the content  
>>>filters to yes or disarm they are still sent. You can use the  
>>>archive function though.
>>>
>>>
>>>      
>>>
>>Ok, I've figured out how to modify this behaviour, in attachments  
>>my patches.
>>
>>Add a new config switch into Mailscanner.conf
>>
>># Do you want to store copies of the modified messages?
>>Quarantine Modified Body = yes
>>
>>Then changed lib/Mailscanner/ConfigDefs.pl, lib/MailScanner/ 
>>MessageBatch.pm and bin/Mailscanner to catch if a message had it's  
>>body
>>modified in any way (disarming  or other checks) and store it in  
>>it's untouched form.
>>
>>P.s. I've not understood completely how to define a new conf  
>>variable, so my 'method' must be confirmed if it's correct.
>>
>>Bye.
>>
>>-- 
>>Dott. Mag. Sergio Rabellino
>>Technical Staff
>>Department of Computer Science
>>University of Torino (Italy)
>>
>>http://www.di.unito.it/~rabser
>>Tel. +39-0116706701
>>Fax. +39-011751603
>>
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>487d486
>>< QuarantineModifiedBody    1    no    0    yes    1
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>628,630d627
>><     # Quarantine all the disarmed attachments
>><     $batch->QuarantineModifiedBody();
>><
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>625,627d624
>>< # Store all the disarmed files in the quarantine if they want me to.
>>< # Quarantine decision has to be done on a per-message basis.
>>< sub QuarantineModifiedBody {
>>629,641d625
>><   my $this = shift;
>><
>><   my($id, $message);
>><
>><   while(($id, $message) = each %{$this->{messages}}) {
>><     next unless $message->{bodymodified};
>><     next if MailScanner::Config::Value('quarantinemodifiedbody',  
>>$message) !~ /1/;
>><
>><     $global::MS->{quar}->StoreInfections($message);
>><     MailScanner::Log::InfoLog("Quarantining modified message for  
>>= " . $id . " bodymodified is " . $message->{bodymodified});
>><   }
>>< }
>><
>>
>>------------------------ MailScanner list ------------------------
>>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>'leave mailscanner' in the body of the email.
>>Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>>Support MailScanner development - buy the book off the website!
>>
>>    
>>
>
>- -- 
>Julian Field
>www.MailScanner.info
>Buy the MailScanner book at www.MailScanner.info/store
>PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
>
>-----BEGIN PGP SIGNATURE-----
>Version: PGP Desktop 9.0.2 (Build 2425)
>
>iQA/AwUBQwsn4RH2WUcUFbZUEQJ8tACgu0eCgADRyl7WGb+FSKeOW9A3DesAn0Jc
>IgqEnuaMPkDIxitkWOMoTmW0
>=s1gW
>-----END PGP SIGNATURE-----
>
>------------------------ MailScanner list ------------------------
>To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>'leave mailscanner' in the body of the email.
>Before posting, read the Wiki (http://wiki.mailscanner.info/) and
>the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
>Support MailScanner development - buy the book off the website!
>  
>


-- 
Dott. Mag. Sergio Rabellino 

 Technical Staff
 Department of Computer Science
 University of Torino (Italy)

http://www.di.unito.it/~rabser
Tel. +39-0116706701
Fax. +39-011751603

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!