Author: Juan Leyva
MDL-56159 webservice: Improve not fully setup and missing pwd checks
Removing the check in login/token.php is secure since the
auth_forcepasswordchange is checked in require_login that is called via
validate_context.
The user must be able to get a token even if that setting is on. With
that token we’ll redirect the user to the site or we’ll change the
password when a new WS for that is available.
http://git.moodle.org/gw?p=moodle.git;a=commit;h=80e0f0b85b8d5a7e1aecfc31f3117426c5e1b029
http://github.com/moodle/moodle/commit/80e0f0b85b8d5a7e1aecfc31f3117426c5e1b029
+ 3.2 en [usernotfullysetup,core_error]