diff --git a/webalizer/CHANGELOG b/webalizer/CHANGELOG
index 51984049d..cd38b0108 100644
--- a/webalizer/CHANGELOG
+++ b/webalizer/CHANGELOG
@@ -11,3 +11,4 @@ Added support for AWFFull, a drop in Webalizer replacement. It is used by defaul
 ---- Changes since 1.670 ----
 Converted the UI to use the standard Webmin library.
 Converted all code to be perl strict and warnings compliant.
+Fixed a security issue that could allow a user without root access to view any file on the system.
diff --git a/webalizer/view_log.cgi b/webalizer/view_log.cgi
index 795d6c9e4..c5bb4c3d4 100755
--- a/webalizer/view_log.cgi
+++ b/webalizer/view_log.cgi
@@ -30,16 +30,12 @@ $file =~ /\.\./ || $file =~ /\<|\>|\||\0/ && &error($text{'view_efile'});
 my $lconf = &get_log_config($log) || &error($text{'view_elog'}." : $log");
 my $full = $lconf->{'dir'}.$file;
 my $fh;
-open($fh, $full) || &error($text{'view_eopen'}." : $full");
+my $data = &eval_as_unix_user($lconf->{'user'} || 'root',
+		sub { &read_file_contents($full) });
+$data || &error($text{'view_eopen'}." : $full");
 
 # Display file contents
 if ($full =~ /\.(html|htm)$/i && !$config{'naked'}) {
-	my $data = "";
-	my $buf;
-	while(read($fh, $buf, 1024)) {
-		$data .= $buf;
-		}
-	close($fh);
 	$data =~ /<TITLE>(.*)<\/TITLE>/i;
 	my $title = $1;
 	$data =~ s/^[\000-\377]*<BODY.*>//i;
@@ -64,10 +60,6 @@ else {
 			       $full =~ /\.(html|htm)$/i ? "text/html" :
 							   "text/plain","\n";
 	print "\n";
-	my $buf;
-	while(read($fh, $buf, 1024)) {
-		print $buf;
-		}
-	close($fh);
+	print $data;
 	}