[Mimedefang] SA report on quarantined report

[Nels Lindquist]

On 13 Mar 2003 at 23:36, Alan Williamson wrote:

> Thanks Nels ... I think I am close here ... but I put this in filter_end()
> and it doesn't seem to work.
> 
> ------------------------------
>   # If you find the SA report useful, add it, I guess...
>   action_add_part($entity, "text/plain", "-suggest",
>                             "$report\n",
>                             "SpamAssassinReport.txt", "inline");
> 
>   action_quarantine_entire_message();
>   push(@Warnings, "$report\n");
>   action_notify_administrator("Message quarantined");
>   send_quarantine_notifications();
> ------------------------------

Sorry!  I should have specified that you need to update the @Warnings 
array prior to calling action_quarantine_entire_message, because 
that's where the contents of @Warnings are written to a file which is 
eventually incorporated into the quarantine message.

Looking through mimedefang-filter(5), it looks like these days you 
should be able to just call:

action_quarantine_entire_message("$report\n");
 
> Another quick one; how does one modify the SUBJECT of the quarantined
> admin message to be the same subject of the offending email?  It would
> make going through them all so much quicker when we are checking for
> false-positives. 

Have a look at the section of mimedefang-filter(5) dealing with 
$NotifyAdministratorSubject and $QuarantineSubject.  You'll need to 
update one of those (not sure which) immediately prior to your 
action_quarantine_entire_message call with the value of $Subject 
(which contains the message subject).

----
Nels Lindquist <*>
Information Systems Manager
Morningstar Air Express Inc.