mailscanner mailwatch quarantine release

[Lyttek]

Not having any luck searching on this, though I found a couple of related posts.

If a message is quarantined, then released from within mailwatch, the quarantined message shows up as either que files in text form, or a text file containing all headers, etc. Any attachments are also included, both as an individual attachment (say, a .WMV file) as well as the encoded text in the original text file.

Confused enough?

Question: Is it possible, and how is it done, that the message and attachments are delivered as original bits, rather than being a set of attachments to the "message released from quarantine"? email, just as if they'd never been quarantined?

I'd like to do this from GUI or similar script, as opposed to logging in and running command line stuff.

[Lyttek]

Figured it out.

Made some modifications to detail.php and functions.php that added a checkbox called 'deliver' to the mailwatch section where you can release a message. Selecting the correct boxes puts a copy of the queue files into /var/spool/exim/input where they are then delivered.

If anyone wants the modified files named above, holler and I'll post the changes*.


* changes are currently for the local quarantine only; I've not looked at changes for the RPC section.

[webignition]

I certainly wouldn't mind knowing how this is done!

[Lyttek]

Here goes:

In /usr/local/cpanel/whostmgr/docroot/3rdparty/mailwatch/functions.php, add the following code:

function quarantine_deliver($list, $num,$rpc_only=false) {
if(!$rpc_only && is_local($list[0]['host']))
{
foreach($num as $key=>$val)
{
$file[$val] = $list[$val]['path'];
$newfile[$val] = '/var/spool/exim/input/'.$list[$val]['file'];
if (!copy($file[$val], $newfile[$val]))
{
// Error
$status = 'Deliver: error'.' F:'.$file[$val].' N:'.$newfile[$val];
$error = true;
} else {
$status = "Release: message released.";
audit_log('Quarantined message ('.$list[$val]['msgid'].') released.');
}
}
return($status);
} else {
// Host is remote - handle by RPC - this section not written
$status = "Not released: RPC delivery not written at this time.";
return($status);
}
}

And in detail.php, make the following additions: (added code in bold, surrounded by existing code)

// sa-learn
if(isset($_GET['learn'])) {
$status[] = quarantine_learn($quarantined,$_GET['learn'],$_GET['learn_type'],RPC_ONLY);
}
// deliver
if(isset($_GET['deliver'])) {
$status[] = quarantine_deliver($quarantined,$_GET['deliver'],RPC_ONLY);
}
// Delete
if(isset($_GET['delete'])) {
$status[] = quarantine_delete($quarantined,$_GET['delete'],RPC_ONLY);
}

echo "<FORM ACTION=\"".$_SERVER['PHP_SELF']."\" NAME=\"quarantine\">\n";
echo "<TABLE BORDER=0 WIDTH=\"100%\" CLASS=\"mail\">\n";
echo " <THEAD>\n";
echo " <TH COLSPAN=8>Quarantine</TH>\n";
echo " </THEAD>\n";
echo " <THEAD>\n";
echo " <TH>Release</TH>\n";
echo " <TH>Deliver</TH>\n";
echo " <TH>Delete</TH>\n";
echo " <TH>SA Learn</TH>\n";

if($item['dangerous'] !== "Y") {
echo " <TD ALIGN=\"CENTER\"><INPUT TYPE=\"checkbox\" NAME=\"release[]\" VALUE=\"".$item['id']."\"></TD>\n";
} else {
echo "<TD>&nbsp;&nbsp;</TD>\n";
}
if($item['dangerous'] !== "Y") {
echo " <TD ALIGN=\"CENTER\"><INPUT TYPE=\"checkbox\" NAME=\"deliver[]\" VALUE=\"".$item['id']."\"></TD>\n";
} else {
echo "<TD>&nbsp;&nbsp;</TD>\n";
}
echo " <TD ALIGN=\"CENTER\"><INPUT TYPE=\"checkbox\" NAME=\"delete[]\" VALUE=\"".$item['id']."\"></TD>\n";

That should do it. It should be noted that in operation, make sure you're quarantining messages as queue files, and DON'T deliver any attachments that are included with the message... just check the two queue files that end in -H and -D, as the latter file will have all the info for the attachments.

Code probably needs to be written to check for correct quarantine configuration and to only allow the 'deliver' checkbox on the two queue files. May need to abstract the destination of the copy function as well.

[webignition]

Thanks for the explanation - I'll give it a shot sometime (when I have the time!) and see how it goes.

Thanks again.

[Lyttek]

here's another question:

Currently, when a message is quarantined, a notification message is returned to the sender... what needs to be done to send a notification to the recipient as well? Looks like that would be a handy configuration, but I can't seem to find anything about that except for spam messages, which aren't quarantined.

[goodmove]

here's another question:

Currently, when a message is quarantined, a notification message is returned to the sender... what needs to be done to send a notification to the recipient as well? Looks like that would be a handy configuration, but I can't seem to find anything about that except for spam messages, which aren't quarantined.

You can set a notification for the recipient in /usr/mailscanner/etc/MailScanner.conf.

Curious, why do you send a notification to the sender? I am only asking as doing so can get your mail server IP address into spam blacklists, as the sender address in spam is usually faked.