MDL-66377 user: Only allow active users to retrieve files via tokenpluginfile.php

lib/moodlelib.php

@@ -3230,6 +3230,8 @@ function require_user_key_login($script, $instance = null, $keyvalue = null) {
         print_error('invaliduserid');
     }
 
+    core_user::require_active_user($user, true, true);
+
     // Emulate normal session.
     enrol_check_plugins($user);
     \core\session\manager::set_user($user);

tokenpluginfile.php

@@ -37,6 +37,7 @@ if (0 == strpos($relativepath, '/token/')) {
     $relativepath = ltrim($relativepath, '/');
     $pathparts = explode('/', $relativepath, 2);
     $token = $pathparts[0];
+    $token = clean_param($token, PARAM_ALPHANUM);
     $relativepath = "/{$pathparts[1]}";
 }