public static function validate_login_token($token = false) {
        global $CFG;

        if (!empty($CFG->alternateloginurl) || !empty($CFG->disablelogintoken)) {
            // An external login page cannot generate the login token we need to protect CSRF on
            // login requests.
            // Other custom login workflows may skip this check by setting disablelogintoken in config.
            return true;
        }
        if ($token === false) {
            // authenticate_user_login is a core function was extended to validate tokens.
            // For existing uses other than the login form it does not
            // validate that a token was generated.
            // Some uses that do not validate the token are login/token.php,
            // or an auth plugin like auth/ldap/auth.php.
            return true;
        }

        $currenttoken = self::get_login_token();

        // We need to clean the login token so the old one is not valid again.
        self::create_login_token();

        if ($currenttoken !== $token) {
            // Fail the login.
            return false;
        }
        return true;
    }
public static function validate_login_token($token = false) {
        global $CFG;

        if (!empty($CFG->alternateloginurl) || !empty($CFG->disablelogintoken)) {
            // An external login page cannot generate the login token we need to protect CSRF on
            // login requests.
            // Other custom login workflows may skip this check by setting disablelogintoken in config.
            return true;
        }
        if ($token === false) {
            // authenticate_user_login is a core function was extended to validate tokens.
            // For existing uses other than the login form it does not
            // validate that a token was generated.
            // Some uses that do not validate the token are login/token.php,
            // or an auth plugin like auth/ldap/auth.php.
            return true;
        }

        $currenttoken = self::get_login_token();

        // We need to clean the login token so the old one is not valid again.
        self::create_login_token();

        if ($currenttoken !== $token) {
            // Fail the login.
            return false;
        }
        return true;
    }
public static function validate_login_token ( $ token = false ) { global $ CFG ; if ( ! empty ( $ CFG -> alternateloginurl ) || ! empty ( $ CFG -> disablelogintoken ) ) { // An external login page cannot generate the login token we need to protect CSRF on // login requests. // Other custom login workflows may skip this check by setting disablelogintoken in config. return true ; } if ( $ token === false ) { // authenticate_user_login is a core function was extended to validate tokens. // For existing uses other than the login form it does not // validate that a token was generated. // Some uses that do not validate the token are login/token.php, // or an auth plugin like auth/ldap/auth.php. return true ; } $ currenttoken = self :: get_login_token ( ) ; // We need to clean the login token so the old one is not valid again. self :: create_login_token ( ) ; if ( $ currenttoken !== $ token ) { // Fail the login. return false ; } return true ; }
Check the submitted value against the stored login token.

@param mixed $token The value submitted in the login form that we are validating.
If false is passed for the token, this function will always return true.
@return boolean If the submitted token is valid.
Check the submitted value against the stored login token .