[Mimedefang] quarantine and notify recipient

[Paul Murphy]

Mark,

Yes, it does.  It you want to notify the sender or recipient as well, you
have to use one of the aditional action routines, or in the case of notifying
the recipient, you need to first ensure that you're using stream_by_recipient
to limit the number of recipients to one and allow differential treatment of
the message based on the recipient's personal policy, and then write your own
notification routine to do the job for you.

For sender notification:

    if (filter_bad_filename($entity)) {

        md_graphdefang_log('bad_filename', $fname, $type);
        action_notify_administrator("An attachment of type $type, named
$fname was dropped.");
        action_quarantine_entire_message("An attachment of type $type, named
$fname was removed from this document as it constituted a security hazard.");
        action_notify_sender("Your message was quarantined.  Please do not
send it again, as we will release it if it is business related");
        return action_discard();  

As a general rule, all recipients believe that their message is vital, and
will automatically ask for it to be released no matter what the reason was
for quarantine.  If you are proactively managing your quarantined messages,
you should be releasing or deleting them according to your policy before they
realise that something is missing.

Alternatively, never quarantine the whole message, only the part you don't
like, which is then replaced by a message, and the modified e-mail delivered
to the recipients.  Why handle two messages when one will do?

Paul.



> -----Original Message-----
> From: Mark Coetser [mailto:mark at bwbtrading.co.za] 
> Sent: 26 July 2005 19:54
> To: mimedefang at lists.roaringpenguin.com
> Subject: RE: [Mimedefang] quarantine and notify recipient
> 
> 
> >From my understanding of send_quarantine_notifications is 
> that it only
> notifies the administrator of the quarantine
> 
> >From the man page
> 
>        send_quarantine_notifications()
>               This function should be called from filter_end. 
>  If any parts
> were quarantined, a quarantine notification is
>               sent to the MIMEDefang administrator.  Please 
> note that if you
> do  not  call  send_quarantine_notifications,
>               then no quarantine notifications are sent.