# John Hardin <jhardin@impsec.org>
# Spams without a text body part first started appearing in 5/2009

# These should be generally useful to other rules as well

header  __CTYPE_MULTIPART_ANY Content-Type =~ /multipart\/\w+/i
header  __PHP_MUA_1           X-Mailer =~ /^PHP\s?v?\/?\d\./
header  __PHP_MUA_2           X-Mailer =~ /^PHP\d$/
meta    __PHP_MUA             __PHP_MUA_1 || __PHP_MUA_2

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader  __ANY_TEXT_ATTACH Content-Type =~ /text\/\w+/i

  meta        __MIME_NO_TEXT    (__CTYPE_MULTIPART_ANY && !__ANY_TEXT_ATTACH)
  meta        MIME_NO_TEXT      __MIME_NO_TEXT && !__CT_ENCRYPTED && !ALL_TRUSTED && !__MSGID_APPLEMAIL && !__USER_AGENT_APPLEMAIL && !__HAS_IN_REPLY_TO && !__HAS_X_REF && !__HS_SUBJ_RE_FW && !__LCL__ENV_AND_HDR_FROM_MATCH
  score       MIME_NO_TEXT      2.00	# limit
  describe    MIME_NO_TEXT      No (properly identified) text body parts
  tflags      MIME_NO_TEXT      publish

  meta        MIME_PHP_NO_TEXT  (MIME_NO_TEXT && __PHP_MUA)
  #score       MIME_PHP_NO_TEXT  2.00
  describe    MIME_PHP_NO_TEXT  No text body parts, X-Mailer: PHP
else
  meta        __ANY_TEXT_ATTACH 0
  meta        __MIME_NO_TEXT    0
endif