Email Filtering Regex Problem

[Fluxman]

Hello,

I want emails containing a PDF or JPG attachment from certain email addresses to be automatically moved to a folder. I'm using the cpanel Email filters.

It works for all email addresses, except one, and I can't think why.

The filter is (simplified):

FROM matches regex:
test\.com|@foo\.com|@bar\.com

AND

Body matches regex:
name=[\s\S]*(\.jpg|\.pdf)
​

(I use "[\s\S]*" because ".*" doesn't work if there are linebreaks in the filename, which can happen sometimes.)

ACTIONS: Deliver to folder ...
STOP PROCESSING RULES​

So, for an example, an email with:

From: "Test Name" <[email protected]>

...and the body containing:
...
Content-Type: application/octet-stream; name=test.pdf
Content-Transfer-Encoding: base64
...
​

would be matched...which it is...in all cases except one... in this case it's always emails from "@foo.com" that are never matched.

The pdfs are never huge...however for the one email address that doesn't work, sometimes the email is usually around 400kb... could the size of the body mean that the regex match fails for larger email?

Many thanks for any insights.

 

[cPanelMichael]

Hello @Fluxman,

Do you notice a difference if you switch from a single filter rule to three separate filter riles (one for each individual domain name instead of defining those domains as part of a regular expression)?

There's some discussion on the thread below you may find helpful as well (regarding filenames that are base64 encoded):

Block custom attachments EXIM issue

Thank you.