Re: [Exim] system filter

Top Page
Delete this message
Reply to this message
Author: Greg Ward
Date:  
To: exim-users
Subject: Re: [Exim] system filter
On 03 August 2001, Clive McDowell said:
> sorry if the answer's obvious but it's Friday and I need to fix this
> quickly. The default system filter seems to bounce messages with
> single .exe or .com suffix attachments as well as those with double
> suffices. Is there a quick way I can disable the former whilst
> retaining the latter?


If you're referring to Nigel Metheringham's filter, a little tweakage of
the regexes ought to do. Eg. change

"(?:file)?name=(\"[^\"]+\\\\.(?:vb[se]|ws[fh]|jse?|exe|com|cmd|shs|hta|bat|scr|pif)\")"

to

"(?:file)?name=(\"[^\"]+(?:\\\\.(?:[^.]+))+\\\\.(?:vb[se]|ws[fh]|jse?|exe|com|cmd|shs|hta|bat|scr|pif)\")"

to match (reject) "foo.doc.exe" or "bar.qux.ding.dong.xls.com", but not
"runme.exe". UNTESTED -- YMMV -- in particular I'm not sure if that
should be "[^.]" or "[^\\\\.]".

Hack the other three regexes with "(...|exe|com|...)" in them similarly.

BTW, there's probably a good reason that runme.exe is rejected by the
Nigels standard filter...

        Greg
-- 
Greg Ward - software developer                gward@???
MEMS Exchange                            http://www.mems-exchange.org