From 8ffab64cbd2dca170cdaae61f60bc6b3164b929c Mon Sep 17 00:00:00 2001
From: Colin Murphy <colin.murphy@wpengine.com>
Date: Tue, 11 Nov 2025 18:56:19 +0000
Subject: [PATCH 1/2] Fixes #481. Added nonce for the detail page for the
 download link.

Added nonce for the download link on the view log page.
---
 .../src/Admin/View/Templates/WPGraphQLLoggerView.php      | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/plugins/wpgraphql-logging/src/Admin/View/Templates/WPGraphQLLoggerView.php b/plugins/wpgraphql-logging/src/Admin/View/Templates/WPGraphQLLoggerView.php
index da22b995..2cf1dc33 100644
--- a/plugins/wpgraphql-logging/src/Admin/View/Templates/WPGraphQLLoggerView.php
+++ b/plugins/wpgraphql-logging/src/Admin/View/Templates/WPGraphQLLoggerView.php
@@ -2,6 +2,8 @@
 
 declare(strict_types=1);
 
+use WPGraphQL\Logging\Admin\ViewLogsPage;
+
 /**
  * Log detail view template.
  *
@@ -17,13 +19,15 @@
 		<h1><?php esc_html_e( 'Log Entry', 'wpgraphql-logging' ); ?></h1>
 		<a href="
 		<?php
+		$wpgraphql_logging_download_nonce = wp_create_nonce( ViewLogsPage::ADMIN_PAGE_DOWNLOAD_NONCE . '_' . $log->get_id() );
 		echo esc_url(
 			admin_url(
 				sprintf(
-					'admin.php?page=%s&action=%s&log=%d',
+					'admin.php?page=%s&action=%s&log=%d&_wpnonce=%s',
 					\WPGraphQL\Logging\Admin\ViewLogsPage::ADMIN_PAGE_SLUG,
 					'download',
-					$log->get_id()
+					$log->get_id(),
+					$wpgraphql_logging_download_nonce
 				)
 			)
 		);

From 3741a129f7e6f6d5fc8c882a5104434d0d09c195 Mon Sep 17 00:00:00 2001
From: Colin Murphy <colinmurphy@users.noreply.github.com>
Date: Tue, 11 Nov 2025 18:59:23 +0000
Subject: [PATCH 2/2] Add nonce for download link on detail page

Added nonce for the detail page for the download link.
---
 .changeset/curly-phones-look.md | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .changeset/curly-phones-look.md

diff --git a/.changeset/curly-phones-look.md b/.changeset/curly-phones-look.md
new file mode 100644
index 00000000..0d11db47
--- /dev/null
+++ b/.changeset/curly-phones-look.md
@@ -0,0 +1,5 @@
+---
+"@wpengine/wpgraphql-logging-wordpress-plugin": patch
+---
+
+chore:  Added nonce for the detail page for the download link.