Add warning to emails

[Rxd]

I have been asked if it is possible to add a warning to emails received from external sources. One of the higher ups was forwarded an email from another company that had a warning on top in colored text "ATTENTION: This email came from an external source. Do not open attachments or click on links from unknown senders or unexpected emails."

Of course they now think that's great and are asking me if it's possible for us to do that also...

[jimimaseye]

It certainly is possible and very easy with a simple script.

[SorenR]

I have been asked if it is possible to add a warning to emails received from external sources. One of the higher ups was forwarded an email from another company that had a warning on top in colored text "ATTENTION: This email came from an external source. Do not open attachments or click on links from unknown senders or unexpected emails."

Of course they now think that's great and are asking me if it's possible for us to do that also...

Hmm... A quick stir in the pot with the wand and voila...

Code: Select all

   Sub ExtSource(oMessage)
      Const txtFrontPage = "{TXT frontpage}"
      Const aspFrontPage = "{HTML frontpage}"
      If oMessage.HasBodyType("text/html") Then oMessage.HTMLBody = aspFrontPage &_
         VBNewLine & VBNewLine & oMessage.HTMLBody
      If oMessage.HasBodyType("text/plain") Then oMessage.Body = txtFrontPage &_
         VBNewLine & VBNewLine & oMessage.Body
      oMessage.save
   End Sub

Create a rule and "run function" from the rule... Use at your own risk

[Rxd]

Thank you so much. That works great.

[rockers96]

Hi I just saw this thread and I am new into hmailserver, I'm wondering if you guys can help me with a more detail instruction on how I can achieve this. I found the rule but I don't what to do next, and where to put the code? Any help will be appreciated. Thanks a lot.

[jimimaseye]

Hi I just saw this thread and I am new into hmailserver, I'm wondering if you guys can help me with a more detail instruction on how I can achieve this. I found the rule but I don't what to do next, and where to put the code? Any help will be appreciated. Thanks a lot.

The code goes in to your EVENTHANDLERS.VBS script. Enable scripts https://www.hmailserver.com/documentati ... ce_scripts.
Add a rule https://www.hmailserver.com/documentati ... rence_rule with an action of RUN FUNCTION "ExtSource".

[rockers96]

Thank you for that quick response, I actually added the code the eventhandlers.vbs, I attached some screenshot. I did enable the script as mentioned but kinda lost in the rule part. Don't know what to put on those fields.

[jimimaseye]

You put i the conditions whatever you feel the conditions should be to trigger the rule. We cannot tell you that. When do you want the rule to be triggered? A specific name? A message size? Inbound to a specific account? Outbound to a specific recipient? A combination of all? What?

Whatever you decide, that is what you set your rule to be using the interface given.

[rockers96]

I manage to get the rule working, one more question, can I highlight the output text or change its color? Thanks a lot.

[jimimaseye]

You can make the additional text anything you like in the script. But formatting only works with the html version (by means of html tags).

[Entered by mobile. Excuse my spelling.]

[kgoodridge]

I realize this is an old topic, but I am going through this process for regulatory compliance. We are moving to O365 soon, but I need this just to get through an audit. Has anything changed with this process that would break it? Syntax changes, etc?

I edited the c:\Program Files (x86)\hMailServer\Events\EventHandlers.vbs file, in Notepad++ as admin, to add the lines of code and edit the 2x text fields. scripting is enabled, reloaded scripts, and checked syntax.

Code: Select all

Sub ExtSource(oMessage)
      Const txtFrontPage = "{CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.}"
      Const aspFrontPage = "{CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.}"
      If oMessage.HasBodyType("text/html") Then oMessage.HTMLBody = aspFrontPage &_
         VBNewLine & VBNewLine & oMessage.HTMLBody
      If oMessage.HasBodyType("text/plain") Then oMessage.Body = txtFrontPage &_
         VBNewLine & VBNewLine & oMessage.Body
      oMessage.save
End Sub

Rules: enabled
Criteria: from: not contains [our domain]
Actions: run function "ExtSource"


Can someone, please, tell me what I could possibly be doing wrong?

You have my sincerest gratitude!!

[mattg]

Is the rule triggered (check debug logs)?

[mattg]

FYI - I just tested your script, called as an action from a global rule and it works fine

That means the issue is your rule

Did you create a global rule or an account rule?

[SorenR]

Rules: enabled
Criteria: from: not contains [our domain]
Actions: run function "ExtSource"


Can someone, please, tell me what I could possibly be doing wrong?

You have my sincerest gratitude!!

"From" is just a mailheader and is generally faked in SPAM and Malware. You need to dig a bit deeper and grab the "MAIL FROM:" address from the SMTP conversation (as seen in the SMTP log).

Include this in Sub OnAcceptMessage(oClient, oMessage)

Code: Select all

    oMessage.HeaderValue("X-Envelope-From") = oMessage.FromAddress
    oMessage.Save

Rules: enabled
Criteria: Custom header field "X-Envelope-From": not contains [our domain]
Actions: run function "ExtSource"

...
...

OR convert your "rule" into script code in Sub OnAcceptMessage(oClient, oMessage) and execute on every email assuming "@acme.inc" is your domain.

Code: Select all

If (InStr(1, oMessage.FromAddress, "@acme.inc", 1) > 0) Then
      Const txtFrontPage = "{CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.}"
      Const aspFrontPage = "{CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.}"
      If oMessage.HasBodyType("text/html") Then oMessage.HTMLBody = aspFrontPage &_
         VBNewLine & VBNewLine & oMessage.HTMLBody
      If oMessage.HasBodyType("text/plain") Then oMessage.Body = txtFrontPage &_
         VBNewLine & VBNewLine & oMessage.Body
      oMessage.save
End If

[kgoodridge]

@mattg

Thanks for the reply

They are placed in the Global rules from what I can tell
It is in the main tree view
Welcome
Status
Domains
Rules <===
Settings
Utilities

It appears to be running the rule...

Code: Select all

"DEBUG"	5280	"2019-11-17 00:09:51.995"	"Applying rules"
"DEBUG"	5280	"2019-11-17 00:09:51.995"	"Applying rule External_Warning"
"DEBUG"	5280	"2019-11-17 00:09:51.995"	"Applying rule REDACTED"
"DEBUG"	5280	"2019-11-17 00:09:51.995"	"Performing local delivery"
"DEBUG"	5280	"2019-11-17 00:09:51.995"	"Applying rules"
"DEBUG"	5280	"2019-11-17 00:09:51.995"	"Saving message: {EE721524-3F95-4B0A-B085-6DA73E9A56A0}.eml"

@SorenR

I tried both methods and I am not seeing any results. It looks like the rules are running, but the email is not getting the text contained.

[mattg]

If rules were triggered, you would see a 'performing rule action' in the logs

The individual rules are being tested, but not matched
You are in the correct spot

Do what this say

Rules: enabled
Criteria: from: not contains [our domain]
Actions: run function "ExtSource"


Can someone, please, tell me what I could possibly be doing wrong?

You have my sincerest gratitude!!

"From" is just a mailheader and is generally faked in SPAM and Malware. You need to dig a bit deeper and grab the "MAIL FROM:" address from the SMTP conversation (as seen in the SMTP log).

Include this in Sub OnAcceptMessage(oClient, oMessage)

Code: Select all

    oMessage.HeaderValue("X-Envelope-From") = oMessage.FromAddress
    oMessage.Save

Rules: enabled
Criteria: Custom header field "X-Envelope-From": not contains [our domain]
Actions: run function "ExtSource"

...
...

OR convert your "rule" into script code in Sub OnAcceptMessage(oClient, oMessage) and execute on every email assuming "@acme.inc" is your domain.

Code: Select all

If (InStr(1, oMessage.FromAddress, "@acme.inc", 1) > 0) Then
      Const txtFrontPage = "{CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.}"
      Const aspFrontPage = "{CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.}"
      If oMessage.HasBodyType("text/html") Then oMessage.HTMLBody = aspFrontPage &_
         VBNewLine & VBNewLine & oMessage.HTMLBody
      If oMessage.HasBodyType("text/plain") Then oMessage.Body = txtFrontPage &_
         VBNewLine & VBNewLine & oMessage.Body
      oMessage.save
End If

[kgoodridge]

OK, so I have the following in my script file... and come to find out that it was working, but it was placing the text into internal emails instead of external ones. How can we modify the rule in this script to add it to external email, and add a couple of <CR> between the notice and the text from the person sending the message? Keep in mind that I am not a coder, so it is not immediately obvious to me.

Code: Select all

If (InStr(1, oMessage.FromAddress, "@acme.inc", 1) > 0) Then
      Const txtFrontPage = "{EXTERNAL EMAIL: CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.}"
      Const aspFrontPage = "{EXTERNAL EMAIL: CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.}"
      If oMessage.HasBodyType("text/html") Then oMessage.HTMLBody = aspFrontPage &_
         VBNewLine & VBNewLine & oMessage.HTMLBody
      If oMessage.HasBodyType("text/plain") Then oMessage.Body = txtFrontPage &_
         VBNewLine & VBNewLine & oMessage.Body
      oMessage.save
End If

My guess is to make the following changes... but I am unsure.


If (InStr(0, oMessage.FromAddress, "@acme.inc", 0) > 1) Then



Please advise

[SorenR]

OK, so I have the following in my script file... and come to find out that it was working, but it was placing the text into internal emails instead of external ones. How can we modify the rule in this script to add it to external email, and add a couple of <CR> between the notice and the text from the person sending the message? Keep in mind that I am not a coder, so it is not immediately obvious to me.

Code: Select all

If (InStr(1, oMessage.FromAddress, "@acme.inc", 1) > 0) Then
      Const txtFrontPage = "{EXTERNAL EMAIL: CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.}"
      Const aspFrontPage = "{EXTERNAL EMAIL: CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.}"
      If oMessage.HasBodyType("text/html") Then oMessage.HTMLBody = aspFrontPage &_
         VBNewLine & VBNewLine & oMessage.HTMLBody
      If oMessage.HasBodyType("text/plain") Then oMessage.Body = txtFrontPage &_
         VBNewLine & VBNewLine & oMessage.Body
      oMessage.save
End If

My guess is to make the following changes... but I am unsure.


If (InStr(0, oMessage.FromAddress, "@acme.inc", 0) > 1) Then



Please advise

Ah yes (how could I miss this? ). Change ...

Code: Select all

If (InStr(1, oMessage.FromAddress, "@acme.inc", 1) > 0) Then

To ...

Code: Select all

If (InStr(1, oMessage.FromAddress, "@acme.inc", 1) = 0) Then

[kgoodridge]

Soren,

Thanks for that info... I will try it shortly...

Is there a way to insert some spacing below the messages so that the inbound message has some delineation?

Current formatting:

{CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.}
Hello, AOM,


Desired formatting:

EXTERNAL EMAIL:
[CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.]


Hello...






Thanks for your help

[kgoodridge]

Soren,

I have been looking this over and think I see how this is supposed to work now. I don't think the code is working correctly.

Code: Select all

If oMessage.HasBodyType("text/html") Then oMessage.HTMLBody = aspFrontPage &_
				VBNewLine & VBNewLine & oMessage.HTMLBody
			If oMessage.HasBodyType("text/plain") Then oMessage.Body = txtFrontPage &_
				VBNewLine & VBNewLine & oMessage.Body

The VBNewLine does not seem to be working

Test message:

EXTERNAL EMAIL: [CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.]
This is an external test

[SorenR]

I generally use VbCrLf for text files. HTML should use the normal formatting for either newline (\n) or paragraph (<br>).

[kgoodridge]

Soren,

Thanks for all of your help. It got it working to the point I can live with it. At least until we move to O365. I appreciate everyone taking the time to help!!!

Adding the <br/> tags helped with the html mail
I tried to use line breaks for the plaintext, but it refused to work. hmail complained about the syntax every time.

Anyway... I am as satisfied as I can be right now!!


Thanks!!

[mattg]

I've got to say that I kind of like this concept

Since I implemented the other day to test, I've been thinking about I will implement this style of thing for all of my users, and under what circumstances.

This could help with the stopping of malware downloads from not very savvy IT user clients.

[katip]

I've got to say that I kind of like this concept

Since I implemented the other day to test, I've been thinking about I will implement this style of thing for all of my users, and under what circumstances.

This could help with the stopping of malware downloads from not very savvy IT user clients.

i think the same and put it as follows under Sub OnDeliverMessage:
it looks if the header X-Spam-Status exists, is "No" AND doesn't contain "USER_IN_WHITELIST"
i.e. message is external, sender isn't whitelisted in HMS neither in SA => from an unknown source, yet it passed => potential evil, open your eyes

it runs fine for the moment. i'd go deeper into X-Spam-Status content to narrow down the risk, but yes, concept is fine indeed. thanks to OP for inspiration.

[SorenR]

Playing with it on mails going into my SPAM Trap ...

Code: Select all

Sub WarningMessage(oMessage)
    Dim txtMsg, aspMsg, strMsg : strMsg = "CAUTION: This email originated from outside of the organization. " &_
                                          "Do not click links or open attachments unless you recognize the " &_
                                          "sender and know the content is safe."
    txtMsg = strMsg & vbCrLf & vbCrLf & oMessage.Body
    aspMsg = "<p style=""background-color:Tomato;"">" & strMsg & "</p>" & oMessage.HTMLBody
    If oMessage.HasBodyType("text/html") Then oMessage.HTMLBody = aspMsg
    If oMessage.HasBodyType("text/plain") Then oMessage.Body = txtMsg
    oMessage.save
End Sub

Still need to trap a plain text message but the HTML ones get a nice red banner at the top

Soren,

Thanks for all of your help. It got it working to the point I can live with it. At least until we move to O365. I appreciate everyone taking the time to help!!!

Adding the <br/> tags helped with the html mail
I tried to use line breaks for the plaintext, but it refused to work. hmail complained about the syntax every time.

Anyway... I am as satisfied as I can be right now!!


Thanks!!

[SorenR]

Code: Select all

Sub WarningMessage(oMessage)
    Dim txtMsg, aspMsg
    If oMessage.HasBodyType("text/plain") Then
        txtMsg = "          ***********************************************************************" & vbCrLf &_
                 "          * CAUTION: This email originated from outside of the organization. Do *" & vbCrLf &_
                 "          * not click links or open attachments unless you recognize the sender *" & vbCrLf &_
                 "          *                     and know the content is safe.                   *" & vbCrLf &_
                 "          ***********************************************************************" & vbCrLf &_
                 "                                                                                 " & vbCrLf
        oMessage.Body = txtMsg & oMessage.Body
    End If
    If oMessage.HasBodyType("text/html") Then
        aspMsg = "<table cellpadding='20' width='650' border='0' align='center' style='background-color: Tomato; font-family: Arial; font-size: 18px; text-align: center;'>" &_
                   "<tbody>" &_
                     "<tr>" &_
                       "<th scope='col'>" &_
                          "CAUTION: This email originated from outside of the organization. Do " &_
                          "not click links or open attachments unless you recognize the sender " &_
                          "and know the content is safe." &_
                       "</th>" &_
                     "</tr>" &_
                   "</tbody>" &_
                 "</table><br>"
        oMessage.HTMLBody = aspMsg & oMessage.HTMLBody
    End If
    oMessage.save
End Sub

[SorenR]

[palinka]

That's awesome. I would use that except 99% of my mail is external.

I love the big red banner.

[jimimaseye]

Our corporate webmail had had such banners for years. Not so heavy on the banner though - just strong words with red and bold text (in body and subject).

[SorenR]

The big red banner was a test.

If you examine the source of the email you will see the warning appear BEFORE the proper HTML tags. Apparently everything works fine all the same.

Code: Select all

<table cellpadding=3D'20' width=3D'650' border=3D'0' align=3D'center' style=3D'background-color: Tomato; font-family: Arial; font-size: 18px; text-align: center;'><tbody><tr><th scope=3D'col'>CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.</th></tr></tbody></table><br>
<!DOCTYPE html> <=== ! HERE
<html> <=== ! HERE
<head> <=== ! HERE
<meta charset=3D"utf-8" />
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dutf-8" />
<meta name=3D"viewport" content=3D"width=3D400" />
<style type=3D"text/css">

[mattg]

follow up on this

I'd like to REMOVE the warnings automatically as a reply or forward is sent out so that others don't see this warning, only local users

I'm still playing, but this would be called from a global rule (currently only my SPAM address)

Code: Select all

Sub ExtSourceSPAM(oMessage)
	'custom event
	'uses functions: 
	'uses globals:
	'called from: Rules
	
    Dim txtMsg, aspMsg
    If oMessage.HasBodyType("text/plain") Then
        txtMsg = "WARNING   ***********************************************************************" & vbCrLf &_
                 "          *         CAUTION: This email was flagged as potential SPAM           *" & vbCrLf &_
                 "          *      Do NOT click links or open attachments unless you recognize    *" & vbCrLf &_
                 "          *              the sender and know the content is safe.               *" & vbCrLf &_
                 "          ***********************************************************************" & vbCrLf &_
                 "                                                                                 " & vbCrLf &_
                 "                                                                     EndOfWarning" & vbCrLf
        oMessage.Body = txtMsg & oMessage.Body
    End If
    If oMessage.HasBodyType("text/html") Then
        On Error Resume Next
        aspMsg = "<table id=""Warning"" cellpadding='20' width='80%' border='0' align='center' style='background-color: Tomato; font-family: Arial;"
        aspMsg = aspMsg & "font-size: 18px; text-align: center;'><tbody><tr><th scope='col'>"
        aspMsg = aspMsg & "CAUTION: This email was flagged as potential SPAM." & "<br><br>"
        aspMsg = aspMsg & "This message is FROM :- " & omessage.From & "<br><br>"
		If oMessage.HeaderValue("Reply-To") <> "" then
	        aspMsg = aspMsg & "The reply to address is :- " & oMessage.HeaderValue("Reply To") & "<br><br>"
		End If
        If oMessage.FromAddress <> "" Then 
	        aspMsg = aspMsg & "The return address is :- " & oMessage.FromAddress & "<br><br>"
			If InStr(oMessage.FromAddress,"bounce",1) > 0 Then
		        aspMsg = aspMsg & "This is likely from a mailing list<br><br>"
				If oMessage.HeaderValue("List-Unsubscribe") <> "" Then
			        aspMsg = aspMsg & "<a href=" & Right(oMessage.HeaderValue("List-Unsubscribe"),Len(oMessage.HeaderValue("List-Unsubscribe"))-1)
			        aspMsg = aspMsg & "To Unsubscribe click here</a><br><br>"
				Else
			        aspMsg = aspMsg & "Do NOT click links or open attachments unless you recognize the sender, "
			        aspMsg = aspMsg & "were expecting the email, and know the content is safe.<br><br>"
				End If
			End If
    	Else
	        aspMsg = aspMsg & "This was downloaded via External Account <br><br>"
    	End If
		On Error GoTo 0
        aspMsg = aspMsg & "</th></tr></tbody></table id=""Warning""><br>"
        oMessage.HTMLBody = aspMsg & oMessage.HTMLBody
    End If
    oMessage.save
End Sub

And this is what I've tried to remove warning, called from OnDeliverMessage

Code: Select all

Function RemoveWarnings(oMessage)
	eventlog.write("Remove Warnings Start")
	oMessage.Body = ReplaceText(oMessage.Body, "(WARNING)[/s/S]*(EndOfWarning" & vbCrLf & ")","")
	eventlog.write("Body replace done")
	oMessage.HTMLBody = ReplaceText(oMessage.HTMLBody,"(<table id=3D""Warning"")[/s/S]*(</table id=3D""Warning""><br>)","")
	eventlog.write("HTML Body replace done")
    oMessage.save
End Function

However it breaks plain text emails (makes them unreadable) and the HTML part just doesn't work for mixed type emails

Any ideas on how to remove the warning from all emails if it exists...?

The actual warning works great, just don't want to alarm original senders if email with warning gets replied to.

[palinka]

Code: Select all

	oMessage.Body = ReplaceText(oMessage.Body, "(WARNING)[/s/S]*(EndOfWarning" & vbCrLf & ")","")
	

[/quote]

I could be wrong, but I don't think you can mix vb and regex like that. Try getting rid of the vb or changing it to regex. \t I think for tab?

Code: Select all

	oMessage.Body = ReplaceText(oMessage.Body, "(WARNING)[/s/S]*(EndOfWarning\t)","")
	

[jimimaseye]

if

Code: Select all

       txtMsg = "WARNING   ***********************************************************************" & vbCrLf &_
                 "          *         CAUTION: This email was flagged as potential SPAM           *" & vbCrLf &_
                 "          *      Do NOT click links or open attachments unless you recognize    *" & vbCrLf &_
                 "          *              the sender and know the content is safe.               *" & vbCrLf &_
                 "          ***********************************************************************" & vbCrLf &_
                 "                                                                                 " & vbCrLf &_
                 "                                                                     EndOfWarning" & vbCrLf

then

replace(oMessage.Body,txtMsg,"")

to remove the warning should work, no?

(not tried it)

[mattg]

replace(oMessage.Body,txtMsg,"")

to remove the warning should work, no?

Yes possibly.

I was hoping to NOT rely on duplicating the same full text, and allowing the warning text to be dynamic.

[mattg]

I could be wrong, but I don't think you can mix vb and regex like that. Try getting rid of the vb or changing it to regex. \t I think for tab?

Code: Select all

	oMessage.Body = ReplaceText(oMessage.Body, "(WARNING)[/s/S]*(EndOfWarning\t)","")
	

Sorry, forgot to include this sub that forms part of my Eventhandler.vbs

Code: Select all

Function ReplaceText(str1, patrn, replStr)
	'custom event
	'uses functions: 
	'uses globals: 
	'called from:
	
   Dim regEx
   Set regEx = New RegExp
   with regEx
      .Pattern = patrn
      .IgnoreCase = True
      .Global = True
   end With
   ReplaceText = regEx.Replace(str1, replStr)
End Function

[SorenR]

The HTML warning you should insert a "begin"-comment and an "end"-comment to give you some boundries so you can nuke whatever is between them.

Code: Select all

    With CreateObject("VBScript.RegExp")
        .Pattern = "(WARNING[\s\S]*EndOfWarning[\r\n]*)"
        .Global = False
        .MultiLine = False
        .IgnoreCase = False
        oMessage.Body = .Replace(oMessage.Body, "")
    End With