Problem with mail filtering

[m0urs]

Hi!

I want to sort out mails from my held mail folder which contain a "helo=urs" in one of the "Received" lines.

Tried to create a filter with the following:

"Received" contains "helo=urs"

but with no success.... Tried the same with a self-defined header field called "Received" but with no success either...

Any idea?

Thanks,

Michael

Here are the "Received" lines of sample message:

Received: (qmail 7247 invoked from network); 13 Jul 2004 04:38:40 -0000

from unknown (192.168.1.101) by blade1.cesmail.net with QMQP; 13 Jul 2004 04:38:40 -0000

from server016.webpack.hosteurope.de (80.237.130.24) by mailgate.cesmail.net with SMTP; 13 Jul 2004 04:38:40 -0000

from eta.mc1.hosteurope.de ([80.237.128.248]) by server016.webpack.hosteurope.de with esmtp (TLSv1:DES-CBC3-SHA:168) (Exim 4.34) id 1BkF3v-0006Yv-F4 for spam2[at]urspringer.de; Tue, 13 Jul 2004 06:38:39 +0200

from server016.webpack.hosteurope.de ([80.237.130.24]) by eta.mc1.hosteurope.de with esmtp (Exim 4.34) id 1BkF3u-00085l-0T for spam2[at]urspringer.de; Tue, 13 Jul 2004 06:38:39 +0200

from p50892eab.dip.t-dialin.net ([80.137.46.171] helo=urs) by server016.webpack.hosteurope.de with asmtp (Exim 4.34) id 1BkF3q-0006YL-TA for spam2[at]urspringer.de; Tue, 13 Jul 2004 06:38:37 +0200

from 194.25.134.72 ([219.148.127.112]) by mailin01.sul.t-online.de with smtp id 1Bjhs5-1sSUD20; Sun, 11 Jul 2004 19:12:13 +0200

from [81.211.18.52] by 194.25.134.72 with SMTP; Mon, 12 Jul 2004 14:15:31 +0500

[m0urs]

Hm, think that is not really true as I have another filter defined which works without a problem in HELD MAIL.

I use the filters manually when I have the HELD MAIL folder open in webmail!

Michael

[dbiel]

Thanks for the input, I did not know that would work.

As far as your specific question of filtering on the headers, I will have to leave that to someone else.

[DavidT]

Manual filtering as you describe does indeed work on the contents of Held Mail, as long as under "Filter Options," the "Allow filter rules to be applied in any mailbox?" option is selected, and the "Show the filter icon on the menubar?" is also selected.

Second, when creating or editing a filter designed to pull mail out of Held Mail, you must not accept the default option "Do this: Deliver to my INBOX:" because that simply leaves the matching messages in your Held Mail (which is part of INBOX). Instead, you have to change the "Do this" to "Deliver to mailbox" and then select "INBOX" from that drop-down. (but I think that "m0urs" already understands this...I'm putting here for other users' edification) :-)

I've just done some rather extensive testing of applying filters to my own Held Mail, and have determined that filtering on the contents of a "Received" header is not currently working. I even put some test messages into my Held Mail folder (dropping them in there using IMAP) so that I'd have messages for which I had the complete raw source, but no matter how simple the string I tried to match in a "Received" header, the filter I created to catch the string failed. I ran tests on "From" and "Body" matches that worked just fine, but filtering on "Received" (out of Held Mail at least) does NOT currently work.

This should be called to the attention of whomever is responsible for the webmail.

David T.

[Wazoo]

Note dropped to JT, but noting that for whatever reasons, I've got quite a backlog going in waiting for answers ... ??

[dbiel]

I want to sort out mails from my held mail folder which contain a "helo=urs" in one of the "Received" lines.

Tried to create a filter with the following:

"Received" contains "helo=urs"

I did some testing and it actually worked for me.

Make sure the radio box "Any of the following is checked" NOT "All of the following"

The following is the test that worked for me.

"Received" "Contains" "helo=crane"

Do this: "Deliver to Mailbox" "test"

(Note: I created a separate test folder for testing)

The following is cut from the headers of my test message

Received: from unknown (192.168.1.101)

  by blade1.cesmail.net with QMQP; 17 Jul 2004 06:52:28 -0000

Received: from blackbird.mail.pas.earthlink.net (207.217.121.90)

  by mailgate.cesmail.net with SMTP; 17 Jul 2004 06:52:27 -0000

Received: from crane-hp.pocket ([10.4.120.44] helo=crane)

by blackbird.mail.pas.earthlink.net with smtp (Exim 3.36 #1)

id 1Blj3b-0007y8-00

Note: color added for easier reading

[DavidT]

I did some testing and it actually worked for me.

Make sure the radio box "Any of the following is checked" NOT "All of the following"

The following is the test that worked for me.

"Received"  "Contains" "helo=crane"

Do this:  "Deliver to Mailbox"  "test"

I wonder what I'm doing differently in my testing? I just tried replicating your test and it failed. I created a "test" sub-folder to my Inbox, then created a new filter using "Any of the following," and "Received Contains (the helo string of a message I put in my Held folder)." Then I saved my filter and applied filters while viewing my Held Mail. The message remained in Held Mail.

Is there some other option that might be different between our accounts that would explain why I can get a "body" or "from" filter to work, but not a "Received"?

David T.

[StevenUnderwood]

The only other thing that pops out at me is:

Do you have any other filters setup?

If you do, do ANY of the filters have the "Stop Processing..." switch enabled?

That switch stops ALL filter processing if that filter is used anywhere.

[DavidT]

The only other thing that pops out at me is:

Do you have any other filters setup?

If you do, do ANY of the filters have the "Stop Processing..." switch enabled?

That switch stops ALL filter processing if that filter is used anywhere.

13703[/snapback]

I thought of that, so when I ran the test, I promoted the test filter to the top of my other filters....no luck. I just now went back and found my only filter with the "Stop" option and removed the "Stop" and re-applied my filters to my Held Mail...still no luck.

I also did some further testing just now, letting my filters move the same message back and forth between my "test" and my Held Mail folders, which works on a Subject-based filter, but not when I test for text in the Received.

I'm very surprised that you seem to be able to make "Received" filters work....are you really sure that's the case?

David T.

[StevenUnderwood]

I did not do the first test and noly have filters looking at To, From, and Subject.

[DavidT]

I did not do the first test and noly have filters looking at To, From, and Subject.

13743[/snapback]

Oh yes...I see that it was "dbiel" who wrote that....so we'll wait for him to chime in again.

[dbiel]

I tried doing some more testing and now it does NOT work, why it worked the first time has be confused now.

[DavidT]

I tried doing some more testing and now it does NOT work, why it worked the first time has be confused now.

OK, thanks. This has now become another open question for the administration to answer.

David T.

[DavidT]

I'm bumping this back to the top of the active topics in this forum, because it's an issue that was never resolved, despite Wazoo sending a not to JT way back on July 13th. This needs to be fixed.

DT

[Wazoo]

Searching for something else, I came across this Topic .. is it still an open issue? I can't recall it coming up again ..

[m0urs]

Sorry, for me it is still not working :-(

[DavidT]

Searching for something else, I came across this Topic .. is it still an open issue?  I can't recall it coming up again ..

It's still open...a consistent and demonstrable bug in the SC webmail implementation. It would be very nice if it could be fixed, because it would allow better filtering options when accessing mail using the webmail interface.

DT

ps - other items on my list of unresolved items:

**No email body display in webmail: "There are no parts that can be displayed inline"

http://forum.spamcop.net/forums/index.php?showtopic=2399

**Erroneous confirmation popup in Webmail ("Are you sure you wish to report this message as spam?"), singular only

http://forum.spamcop.net/forums/index.php?...indpost&p=16013

**Virus Notifications - under Options - no longer get sent: (now by design, but should be removed from webmail Options)

http://forum.spamcop.net/forums/index.php?...=findpost&p=221

http://forum.spamcop.net/forums/index.php?showtopic=579

http://forum.spamcop.net/forums/index.php?showtopic=2673

(by design....JT said no more notifications, despite continued "SpamCop Email System Preferences" option --

found in "Options/SpamCop Tools/Select your email forwarding, change your password or mail reports")

The option should be removed, so that people don't think they're going to be notified.

[jefft]

ps - other items on my list of unresolved items:

**No email body display in webmail: "There are no parts that can be displayed inline"

http://forum.spamcop.net/forums/index.php?showtopic=2399

My understanding is that this only happens when the email has invalid MIME. Is this incorrect? While other email clients might display something, working around broken email isn't a top priority.

**Erroneous confirmation popup in Webmail ("Are you sure you wish to report this message as spam?"), singular only

http://forum.spamcop.net/forums/index.php?...indpost&p=16013

The problem is a limitation of web page programming. You can specify a java scri_pt alert that happens when a link is clicked. However, you have to specify the contents of that alert when you original page is displayed. This is before the user clicks any boxes at all. So, there's no opportunity to change that text based on how many boxes you checked. And I don't really like "Are you sure you wish to report these (these) message(s) as spam". While that might be technically more correct, I don't think it really adds anything and is uglier.

**Virus Notifications - under Options - no longer get sent: (now by design, but should be removed from webmail Options)

http://forum.spamcop.net/forums/index.php?...=findpost&p=221

http://forum.spamcop.net/forums/index.php?showtopic=579

http://forum.spamcop.net/forums/index.php?showtopic=2673

(by design....JT said no more notifications, despite continued "SpamCop Email System Preferences" option --

found in "Options/SpamCop Tools/Select your email forwarding, change your password or mail reports")

The option should be removed, so that people don't think they're going to be notified.

17858[/snapback]

I'll try to remember to remove this. I had hoped to add this back in at some point in time, but the number of viruses we receive is incredible.

JT

[turetzsr]

Hi, JT!

<snip>Hi, JT!

<snip>

**Erroneous confirmation popup in Webmail ("Are you sure you wish to report this message as spam?"), singular only

http://forum.spamcop.net/forums/index.php?...indpost&p=16013

17858[/snapback]

The problem is a limitation of web page programming. You can specify a java scri_pt alert that happens when a link is clicked. However, you have to specify the contents of that alert when you original page is displayed. This is before the user clicks any boxes at all. So, there's no opportunity to change that text based on how many boxes you checked.<snip>

17882[/snapback]

...Really? Then is the following something that only works in my environment (IE 6 under Win 2k SP3)?

<html>

<head>

<scri_pt language="java scri_pt">
<!--

function funOnSubmit()
{
	var objCheckboxes = myform.getElementsByTagName('INPUT');
	var intCheckboxes = 0;
	var intCheckbox;
	var objCheckbox;
	var strMessage;
	for ( intCheckbox = 0; intCheckbox < objCheckboxes.length; intCheckbox++ )
	{
  objCheckbox = objCheckboxes(intCheckbox);
  if ( objCheckbox.type == 'checkbox' )
  {
 	 if ( objCheckbox.checked )
 	 {
    intCheckboxes++;
 	 }
  }
	}
	strMessage = intCheckboxes + ' box';
	if ( intCheckboxes != 1 )
	{
  strMessage += 'es are';
	}
	else
	{
  strMessage += ' is';
	}
	strMessage += ' checked.';
	alert ( strMessage );
	return false;
}

// -->
</scri_pt>

</head>

<body>

<form id="myform" name="myform" onsubmit="return funOnSubmit();">
	<input type="checkbox" id="chk1" name="chk1" />First
	<br /><input type="checkbox" id="chk2" name="chk2" />Second
	<br /><input type="checkbox" id="chk3" name="chk3" />Third
	<br /><input type="checkbox" id="chk4" name="chk4" />Fourth
	<br /><input type="Submit" value="submit" />
</form>

<span id="spnMessage" visibility="hidden"></span>

</body>

</html>

[DavidT]

My understanding is that this only happens when the email has invalid MIME. Is this incorrect? While other email clients might display something, working around broken email isn't a top priority.

You might be right (about the invalid MIME), in that these messages are generally declared at "multipart" and yet only contain an HTML section. The confusing part is that the IMP mailbox display will usually show us some (extracted?) text out of the HTML body, and yet, when we open the individual email, we're not presented with an "unnamed" link with the "download" or "strip attachment" icons, as is the case when a message has a "text/html" content type. But I see your point, and I'll drop this one off my "list." :-)

And I don't really like "Are you sure you wish to report these (these) message(s) as spam". While that might be technically more correct, I don't think it really adds anything and is uglier.

OK...no big deal....I'll take if off my list as having been answered.

I'll try to remember to remove this. I had hoped to add this back in at some point in time, but the number of viruses we receive is incredible.

I can imagine. The main downside is that if some of our online "friends" have infected computers that are spewing out worms with our own addresses on them, we won't receive a copy so that we can track them down and notify them. But, more broadband ISPs are implementing SMTP blocking, so the problem seems to be diminishing somewhat. It would be good to temporarily remove the option from the interface, if it's not too much trouble.

Thanks for your answers....but what about the actual topic of this thread....the broken "Received" header filtering?

DT