Catalyst: Download Logfile securely

Question

I have the following problem:

my Catalyst Webservice uses Log4Perl to generate a logfile which logs all user activities.

How can i provide this file as download only for admins? The root directory is no option, because everybody could download it. I need a secure way. Admins have a separate area within the webservice to manage the users.

Using ssh / sftp is unfortunately also no option, the log has to be available over the webservice.

How do you ensure that admins only can access that separate area? — memowe, Nov 24 '12 at 09:51
Admins have a separate login mask und the created session is different, this is no problem and works fine — theguest, Nov 26 '12 at 09:07
Why don't you just use that session in a log-file-sending action to authenticate admins? :) — memowe, Nov 26 '12 at 10:12
And how do i create this log-file-sending action???? I tried something, but it didn't work. — theguest, Nov 26 '12 at 12:05

score 1 · Answer 1 · answered Nov 29 '12 at 01:08

To build a log-file-sending action as @memowe suggested, you will need a controller that does the following things:

Verify the logged-in user is an admin, and redirect if not.
Create a scalar $filehandle to read the log-file.
Use $c->res->content_type(something) and $c->res->header('Content-Disposition' => 'attachment') to force the response to be treated as a download for the browser to present the "Save As..." dialog.
Set $c->res->body($filehandle) to return the contents of the log-file and bypass your View renderer (Template or whatever).

Hopefully that should get you on your way.

score 0 · Accepted Answer · answered Dec 04 '12 at 11:08

Sorry, i was really busy the last few days.
Thanks for your help, thats the solution i have built and it works :-)

sub log : Chained('base_admin') PathPart('log') Args(0) {
    my ( $self, $c ) = @_;
    my $logfile = $c->path_to('test.log');

    $c->response->header('Content-Type' => 'text/plain');
    $c->response->header('Content-Disposition' => 'attachment; filename=test.log');
    $c->serve_static_file($logfile);
}

Catalyst: Download Logfile securely

2 Answers2