Content filtering false positives

[bkiser]

I've created a content filter, it is:
Condition 1 - Any body text line contains "nude".
Action 1 - Delete email.

When people are sending PDF documents it is triggering this rule and deleting the email. I removed the rule and had the documents sent to me, I open them up in Adobe Acrobat and search for "nude" and it doesn't find it anywhere. I'm having the same problem with the same rule but for other words such at "penis" and "viagra". I delete the rules, have the documents sent to me and I can't find those words anywhere. Is there a way to set the content filtering not to search in attachments? What could be causing this?

-Ben Kiser

[Code Crafters]

If the condition triggers then it must appear somewhere in the raw text of the email. Note that attachments are sent encoded so what's sent in the raw email source is different to the content of an opened attachment. You can view the source of the emails via the source view in WebMail or by opening the text file for the mail directly to inspect why these might be triggering.

If you want you can send me your contentfiltering.ini and the raw email files that are triggering that shouldn't to chris@code-crafters.com and I'll have a look at why they might be failing. Obviously for now don't delete the emails but instead edit the subject to something like "<rude> ####SUBJECT####" so that the emails can be passed through but still shown as detected.

[bkiser]

You were correct, I searched the raw text code and found the words that were triggering the content filter. Is there any way to create a content filter that ignores text in and attachment? I only want it to search the subject and main text body.

-Ben Kiser

[Code Crafters]

There is no way in the current version to specify only text and html sections rather than full mail body. Usually though attachments are continuous characters with no spaces so perhaps using spaces in your conditions could help separate the 2 (e.g. STRING CONTAINS "nude ; nude ; nude" etc.) I will pass on your suggestion for a separate text, html, attachment string comparison condition for future updates.