[Mimedefang] Virus/MIME Issue

[David F. Skoll]

Chris Masters wrote:

> For me, the problem with doing virus scanning in
> filter_begin (or filter_end) is that I need to have
> the ability to replace/remove the infected part/entity
> [if required].

If that's a self-imposed requirement, you may want to
rethink it.  If it's a customer-imposed requirement,
you may want to do some customer education. :-)

[...]

> I guess the solution here to do both. Although I
> thought I read somewhere (can't find it now) that
> either the message_contains or entity_contains
> functions were to be depricated. 

Right.  Your solution has to be to do both, and use logic like this:

1) Found a virus in filter()?  Delete or replace the part.

2) Found a virus in filter_end(), but NOT in filter()?  Assume bizarre
   MIME and reject or drop the entire message.

Regards,

David.