Office 365 journaling messages header not parsed correctly

[Matyas]

For Office 365 journaling messages:

Symptoms:

In Web UI lower view pane headers are empty.

Message contains the journaling headers.

Message download eml file starts like this:

Content-Transfer-Encoding: binary

From: Firstname Lastname [e-mail]
To: Firstname Lastname [e-mail]
Subject: Test
Thread-Topic: Test
Thread-Index: Adb5N4+dBQkQxorrQRys+KdNvtsSgA==
Date: Tue, 2 Feb 2021 07:46:59 +0000
Message-ID: [e-mail]

‌

Cause:

removeJournal function in mime.php does not work properly because in the original message is like this:

Content-Type: message/rfc822
Content-Transfer-Encoding: binary

From: …

and thec urrent code expects that “message/rfc822” to be followed by newline an not Content-Transfer…

A quick fix I tried was to replace “message/rfc822” in the removeJournal with “Encoding: binary” and it works but I’m not sure it covers all the cases.

Many thanks.

‌

‌

[Janos SUTO]

Please send me such a test email with full headers to see it for myself.

[Matyas]

I attached a such a message. It is complete including full headers only some of the IP addresses and emails/domains have been edited for data protection.

[Janos SUTO]

Thanks, I’ll keep you posted.

[Janos SUTO]

What piler version is this? I’ve sent the attachment to the test environment (running 1.3.10), and it showed the email content properly.

[Matyas]

The version is piler-1.3.5-f2e4cb1.el7.x86_64. No difference with the latest mime.php from the repo.

The “Content-Transfer-Encoding: binary” ;ine which folllows the “Content-Type: message/rfc822” makes removeJournal to retun the $message starting with Content-Transfer-Encoding: binary followed by an empty line. Normally the resulting $message should start with From: header.

‌

‌

‌

‌

[Janos SUTO]

I believe that there might be some difference. I’d like you to get the latest master branch, and try it with its gui as well.

[Janos SUTO]

No news is good news.