Search moodle.org's
Developer Documentation

See Release Notes

  • Bug fixes for general core bugs in 4.3.x will end 7 October 2024 (12 months).
  • Bug fixes for security issues in 4.3.x will end 21 April 2025 (18 months).
  • PHP version: minimum PHP 8.0.0 Note: minimum PHP version has increased since Moodle 4.1. PHP 8.2.x is supported too.
/login/ -> token.php (source)
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.

/**
 * Return token
 * @package    moodlecore
 * @copyright  2011 Dongsheng Cai <dongsheng@moodle.com>
 * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 */

define('AJAX_SCRIPT', true);
define('REQUIRE_CORRECT_ACCESS', true);
define('NO_MOODLE_COOKIES', true);

require_once(__DIR__ . '/../config.php');
< require_once($CFG->libdir . '/externallib.php');
// Allow CORS requests. header('Access-Control-Allow-Origin: *'); if (!$CFG->enablewebservices) { throw new moodle_exception('enablewsdescription', 'webservice'); } // This script is used by the mobile app to check that the site is available and web services // are allowed. In this mode, no further action is needed. if (optional_param('appsitecheck', 0, PARAM_INT)) { echo json_encode((object)['appsitecheck' => 'ok']); exit; } $username = required_param('username', PARAM_USERNAME); $password = required_param('password', PARAM_RAW); $serviceshortname = required_param('service', PARAM_ALPHANUMEXT); echo $OUTPUT->header(); $username = trim(core_text::strtolower($username)); if (is_restored_user($username)) { throw new moodle_exception('restoredaccountresetpassword', 'webservice'); } $systemcontext = context_system::instance(); $reason = null; $user = authenticate_user_login($username, $password, false, $reason, false); if (!empty($user)) { // Cannot authenticate unless maintenance access is granted. $hasmaintenanceaccess = has_capability('moodle/site:maintenanceaccess', $systemcontext, $user); if (!empty($CFG->maintenance_enabled) and !$hasmaintenanceaccess) { throw new moodle_exception('sitemaintenance', 'admin'); } if (isguestuser($user)) { throw new moodle_exception('noguest'); } if (empty($user->confirmed)) { throw new moodle_exception('usernotconfirmed', 'moodle', '', $user->username); } // check credential expiry $userauth = get_auth_plugin($user->auth); if (!empty($userauth->config->expiration) and $userauth->config->expiration == 1) { $days2expire = $userauth->password_expire($user->username); if (intval($days2expire) < 0 ) { throw new moodle_exception('passwordisexpired', 'webservice'); } } // let enrol plugins deal with new enrolments if necessary enrol_check_plugins($user); // setup user session to check capability \core\session\manager::set_user($user); //check if the service exists and is enabled $service = $DB->get_record('external_services', array('shortname' => $serviceshortname, 'enabled' => 1)); if (empty($service)) { // will throw exception if no token found throw new moodle_exception('servicenotavailable', 'webservice'); } // Get an existing token or create a new one.
< $token = external_generate_token_for_current_user($service);
> $token = \core_external\util::generate_token_for_current_user($service);
$privatetoken = $token->privatetoken;
< external_log_token_request($token);
> \core_external\util::log_token_request($token);
$siteadmin = has_capability('moodle/site:config', $systemcontext, $USER->id); $usertoken = new stdClass; $usertoken->token = $token->token; // Private token, only transmitted to https sites and non-admin users. if (is_https() and !$siteadmin) { $usertoken->privatetoken = $privatetoken; } else { $usertoken->privatetoken = null; } echo json_encode($usertoken); } else { throw new moodle_exception('invalidlogin'); }