Still, I might suggest that you use HTTP authentication to do something like that. That way you can use the same standard URL, but allow the HTTP authentication to determine who gets access to it.

Saving that, it looks like the technique you describe should work for you. I might extend it to put the filename in the "path_info" variable for your script.

use CGI ':standard';
use File::Spec 'rel2abs';

my $base = '/www';

my $filename = rel2abs(path_info, $base);

if ($filename =~ /^\Q$base/ && open(F, "< $filename\0") && -f F) {
   print "Content-type: application/pdf\n";   # or whatever
   print "Content-length: ", -s F, "\n\n";

   print while <F>;
   close(F);
} else {
   # handle errors, perhaps do a Status: 403 or 404
   # along with a nice description, using $! if you want
}
[download]

http://www.example.com/cgi-bin/script.pl/path/filename.pdf
[download]

Your best bet is to build some kind of ACL functionality into the webserver.

If you really can't do that, then the CGI version you're describing is doable. But I wouldn't worry about putting the URL in a database or anything like that. You're not interested in hiding the address, just restricting access to it. I'd just use the filename in the URL: http://www.tmtm.com/cgi-bin/get_file?name=foo.pdf

Then I'd just move the documents outside the webtree, check if the user is allowed, and if so serve up the required document.

Tony