As I already told you I'd prefer if you changed the order of the logic.
1. Check if the file exists (you don't need the CFile instance for that yet). If not, set the error to MHD_HTTP_NOT_FOUND and return.
2. Check if you have a .log or a .xml file. If no, go to #3, otherwise go to #4.
3. As you don't need to run the password removal stuff, save the path of the file and set HTTPFileDownload as the response type and return.
4. As you need to run the password removal stuff, you can now create the CFile instance and open the file for reading and whatever other magic you perform.