MDL-65075 tool_mobile: Allow auto-login keys only for requests from Moodle apps

This change enhances security and avoid any kind of XSS attack.
2019-04-05 09:53:38 +02:00
parent 280cfdf05c
commit 2b34a55d5a
6 changed files with 49 additions and 1 deletions
@@ -262,6 +262,8 @@ class external extends external_api {
    /**
     * Creates an auto-login key for the current user. Is created only in https sites and is restricted by time and ip address.
     *
+     * Please note that it only works if the request comes from the Moodle mobile or desktop app.
+     *
     * @param string $privatetoken the user private token for validating the request
     * @return array with the settings and warnings
     * @since  Moodle 3.2