dravek / moodle-tool_powerusers

This plugin uses the Marvel API to generate users in your Moodle instance

Power users generator

This generator uses the Marvel API to generate users from your favorite characters in your Moodle instance.

To generate a user just type the name and press the button. The user will be automatically created in your Moodle instance. This user will be created with the name, profile picture and description. By default the password for all generated users will be generated randomly, but you have the option to add your own password manually.

You can get your own keys for free signing up at https://developer.marvel.com. All characters generated by this plugin are property of Marvel.

moodle-tool_powerusers's Issues

Missing capablity check on user creation

As mentioned by Tomasz in the review process, the index.php is missing a require_capability check - you could probably use something like:
require_capability('moodle/site:config', context_system::instance());

or implement your own capability so that you can give certain roles the ability to add the users.

missing privacy api

Please note - all plugins that implement an integration with an external service are required to implement the privacy api - I think in your case you can implement the null provider as your plugin doesn't pass any personal identifying information to the external api, and you don't store any personal information in the plugin itself.

hard-coded password for all uses presents security risk.

I'm a little uncomfortable with this line:
https://github.com/dravek/moodle-tool_powerusers/blob/master/classes/generator.php#L107

I think by default it should randomly assign a different password for each user (or even better - not set a password at all.)

basically this would allow someone to go looking for sites that have installed your plugin then try to login with the generic password, giving them authenticated access to the site.