Bug 1595789: More prominent documentation of urlsecret.

Change-Id: I293c5ac256b2325327eb934205ff334c8c596879
behatnotneeded: Documentation only
(cherry picked from commit 31ab623e)

README.md

@@ -40,6 +40,12 @@ To upgrade an existing Mahara installation, follow the instructions here:
 
  * https://wiki.mahara.org/wiki/System_Administrator%27s_Guide/Upgrading_Mahara
 
+If you are upgrading from Mahara 15.10 or earlier, you will need to add a "urlsecret"
+value to your config.php file if you wish to use the web-based upgrade and/or cron
+scripts. See:
+
+ * https://wiki.mahara.org/wiki/System_Administrator%27s_Guide/Upgrading_Mahara#Q:_I.27m_getting_an_error_about_a_.22urlsecret.22
+
 # SYSTEM REQUIREMENTS
 
 Here are the system requirements needed to run Mahara 16.04.

htdocs/config-dist.php

@@ -66,6 +66,15 @@ $cfg->dataroot = '/path/to/uploaddir';
 // Example:
 // $cfg->wwwroot = 'https://myhost.com/mahara/';
 
+/**
+ * urlsecret A secret you need to add to the lib/cron.php or admin/upgrade.php
+ * URL to run it through the browser rather than the commandline to prevent unauthorised users triggering
+ * the cron or an upgrade, eg http://example.com/lib/cron.php?urlsecret=mysupersecret.
+ *
+ * You can disable this functionality by setting $cfg->urlsecret = null.
+ */
+// $cfg->urlsecret = 'mysupersecret';
+
 /**
  * passwordsaltmain: A secret token used for one-way encryption of user account passwords.
  */