filter condition for "no attachment"

[daro]

Hello,
I need a condition for a filter that matches if there is NO attachment at all.

I have tried something like this, but that does not seem to work.

attachment-filename != "^.$"

any suggestions.

thanks
Cheers
Daniel

[Libin Varghese]

The regex you are currently testing with matches one character alone.

I would recommend using just "."

attachment-filename != "."

- Libin V

[daro]

Hello Libin,
I tried with the suggested command, but that does not seem to work.

do you know any other simple way to get such a condition?

thanks
cheers
Daniel

[Libin Varghese · Accepted solution]

Daniel,

The below message filter appears to work for me on the lab device.

Filter1:
if NOT(attachment-filename == ".")
{
log-entry("Attachment not Present");
}

- Libin V

[daro]

thank you

NOT(attachment-filename ==".") works, but (attachment-filename != ".") does not work.
which means I have to use a message filter to get that result.

anyway, thank you for looking into this.

cheers
Daniel

[exMSW4319]

If you prefer to keep your logic in your GUI as far as is possible then the message filter could just add a header and a subsequent content rule could pick up on the header.

Depending on the security implications for your application, you might need to invert the logic and flag "this mail has attachments" rather than "this mail has no attachments" which could lead to some rather contorted logic, or you might add a precautionary strip action.

[daro]

I am using some other condition with those filters and I want to add different actions based on the fact if there is an attachment or not.

condition A + attachment
 = warning 1

condition A + no attachment
 = warning 2

in my case using skip-filter in combination with the correct order was not possible, so I wanted to have a direct condition that matches the fact "NO attachment"

[exMSW4319]

Yes, to be absolutely safe you would want an apparently redundant strip-attachment (bytes > 0) action on the second rule in case some bright spark were to fake the proposed header.