MDL-65075 tool_mobile: Allow auto-login keys only for requests from Moodle apps

This change enhances security and avoid any kind of XSS attack.

admin/tool/mobile/classes/api.php

@@ -297,6 +297,11 @@ class api {
             throw new moodle_exception('enablewsdescription', 'webservice');
         }
 
+        // Only requests from the Moodle mobile or desktop app. This enhances security to avoid any type of XSS attack.
+        if (!\core_useragent::is_moodle_app()) {
+            throw new moodle_exception('apprequired', 'tool_mobile');
+        }
+
         if (!is_https()) {
             throw new moodle_exception('httpsrequired', 'tool_mobile');
         }

admin/tool/mobile/classes/external.php

@@ -262,6 +262,8 @@ class external extends external_api {
     /**
      * Creates an auto-login key for the current user. Is created only in https sites and is restricted by time and ip address.
      *
+     * Please note that it only works if the request comes from the Moodle mobile or desktop app.
+     *
      * @param string $privatetoken the user private token for validating the request
      * @return array with the settings and warnings
      * @since  Moodle 3.2