On Fri, July 28, 2006 13:14, Ramprasad wrote:
> From: Rory [mailto:[EMAIL PROTECTED]
> From: Barbra [mailto:[EMAIL PROTECTED]
>
> Can I write a ruleset to hit these froms
yes
attached a rule for this
--
Benny
# > header TWO_SUBJS ALL =~ /(?:^|\n)Subject:.*\nSubject:/s
# > header DOUBLE_SUBJECT ALL =~ /\nSubject: *\nSubject:.\s+\S/m
#
# So this is what it boils down to, tested:
#
# header L_DOUBLE_SUBJECT ALL =~ /^Subject:.*^Subject:/smi
# describe L_DOUBLE_SUBJECT rfc forbids two subject lines
# score L_DOUBLE_SUBJECT 0.9
# header L_DOUBLE_FROM ALL =~ /^From:.*^From:/smi
# describe L_DOUBLE_FROM rfc forbids two from lines
# score L_DOUBLE_FROM 0.9
#
# Thanks to both of you, Justin and Loren.
#
# Mark
#
header __DOUBLE_SUBJ ALL =~ /^Subject:.*^Subject:/smi
header __DOUBLE_FROM ALL =~ /^From:.*^From:/smi
meta DOUBLE_SUBJ_OR_FROM __DOUBLE_SUBJ || __DOUBLE_FROM
describe DOUBLE_SUBJ_OR_FROM Contains more than one Subject or From header
score DOUBLE_SUBJ_OR_FROM 2.0
