original_string: public static function validate_login_token($token = false) {
          global $CFG;
  
          if (!empty($CFG->alternateloginurl) || !empty($CFG->disablelogintoken)) {
              // An external login page cannot generate the login token we need to protect CSRF on
              // login requests.
              // Other custom login workflows may skip this check by setting disablelogintoken in config.
              return true;
          }
          if ($token === false) {
              // authenticate_user_login is a core function was extended to validate tokens.
              // For existing uses other than the login form it does not
              // validate that a token was generated.
              // Some uses that do not validate the token are login/token.php,
              // or an auth plugin like auth/ldap/auth.php.
              return true;
          }
  
          $currenttoken = self::get_login_token();
  
          // We need to clean the login token so the old one is not valid again.
          self::create_login_token();
  
          if ($currenttoken !== $token) {
              // Fail the login.
              return false;
          }
          return true;
      }
code: public static function validate_login_token($token = false) {
          global $CFG;
  
          if (!empty($CFG->alternateloginurl) || !empty($CFG->disablelogintoken)) {
              // An external login page cannot generate the login token we need to protect CSRF on
              // login requests.
              // Other custom login workflows may skip this check by setting disablelogintoken in config.
              return true;
          }
          if ($token === false) {
              // authenticate_user_login is a core function was extended to validate tokens.
              // For existing uses other than the login form it does not
              // validate that a token was generated.
              // Some uses that do not validate the token are login/token.php,
              // or an auth plugin like auth/ldap/auth.php.
              return true;
          }
  
          $currenttoken = self::get_login_token();
  
          // We need to clean the login token so the old one is not valid again.
          self::create_login_token();
  
          if ($currenttoken !== $token) {
              // Fail the login.
              return false;
          }
          return true;
      }
code_tokens: public static function validate_login_token ( $ token = false ) { global $ CFG ; if ( ! empty ( $ CFG -> alternateloginurl ) || ! empty ( $ CFG -> disablelogintoken ) ) { // An external login page cannot generate the login token we need to protect CSRF on // login requests. // Other custom login workflows may skip this check by setting disablelogintoken in config. return true ; } if ( $ token === false ) { // authenticate_user_login is a core function was extended to validate tokens. // For existing uses other than the login form it does not // validate that a token was generated. // Some uses that do not validate the token are login/token.php, // or an auth plugin like auth/ldap/auth.php. return true ; } $ currenttoken = self :: get_login_token ( ) ; // We need to clean the login token so the old one is not valid again. self :: create_login_token ( ) ; if ( $ currenttoken !== $ token ) { // Fail the login. return false ; } return true ; }
docstring: Check the submitted value against the stored login token.
  
  @param mixed $token The value submitted in the login form that we are validating.
  If false is passed for the token, this function will always return true.
  @return boolean If the submitted token is valid.
docstring_tokens: Check the submitted value against the stored login token .