From 06421beb6b77421ff4d0e2633b1bc356acb444b8 Mon Sep 17 00:00:00 2001
From: Jeppe B <2jepp9350@gmail.com>
Date: Mon, 1 Jun 2026 22:57:23 +0200
Subject: [PATCH] Require token for wash certificate downloads

---
 .../app/modules/washcertificates/certificates/index.php   | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/services/nginx/app/modules/washcertificates/certificates/index.php b/services/nginx/app/modules/washcertificates/certificates/index.php
index fd934a74..2facb827 100644
--- a/services/nginx/app/modules/washcertificates/certificates/index.php
+++ b/services/nginx/app/modules/washcertificates/certificates/index.php
@@ -20,7 +20,11 @@ if (!is_numeric($certificate_id) || $certificate_id < 1) {
     return;
 }
 
-// TODO: Add authentication here
+// Require a valid static token before serving certificates
+if (!isset($_GET['secret_token']) || $_GET['secret_token'] !== $WORDPRESS_STATIC_TOKEN) {
+    header('HTTP/1.0 401 Unauthorized');
+    return;
+}
 
 // Check if the certificate exists in the /output/certificates folder
 if (!file_exists("../output/certificates/wash_certificate_" . $certificate_id . ".pdf")) {
@@ -34,4 +38,4 @@ header('Content-Disposition: attachment; filename="wash certificate ' . $certifi
 
 // Output the certificate
 readfile("../output/certificates/wash_certificate_" . $certificate_id . ".pdf");
-exit;
\ No newline at end of file
+exit;