Add admin check for the stream/read-logs functions (#2919) (#2948)

neo4j-contrib · May 30, 2022 · 8a9d0ca · 8a9d0ca
1 parent bcbc626
commit 8a9d0ca
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/core/src/main/java/apoc/log/Neo4jLogStream.java b/core/src/main/java/apoc/log/Neo4jLogStream.java
@@ -38,6 +38,7 @@ public int compareTo(FileEntry o) {
         }
     }
 
+    @Admin
     @Procedure(mode=Mode.DBMS)
     @Description( "apoc.log.stream('neo4j.log', { last: n }) - retrieve log file contents, optionally return only the last n lines" )
     public Stream<FileEntry> stream(

diff --git a/docs/asciidoc/modules/ROOT/partials/usage/apoc.log.stream.adoc b/docs/asciidoc/modules/ROOT/partials/usage/apoc.log.stream.adoc
@@ -1,3 +1,6 @@
+NOTE: To use the `apoc.log.stream` procedure the user must have the `admin` role, otherwise the procedure throws with an error `permission has not been granted for user 'xxx'`,
+to make sure that only the Administrator can access the logs, which could provide sensitive data.
+
 The following returns the last 10 lines in `neo4j.log`:
 
 [source,cypher]