From c1fc12b47930dfbc1c3cc495d32e89bb67cf86f6 Mon Sep 17 00:00:00 2001
From: Brendan Heywood <brendan@catalyst-au.net>
Date: Sat, 11 Nov 2023 19:36:24 +1100
Subject: [PATCH] MDL-80080 session: Unset logintoken after use

---
 lib/classes/session/manager.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/classes/session/manager.php b/lib/classes/session/manager.php
index 433273889c5..bc113b1e94a 100644
--- a/lib/classes/session/manager.php
+++ b/lib/classes/session/manager.php
@@ -1272,7 +1272,7 @@ class manager {
      * @return boolean If the submitted token is valid.
      */
     public static function validate_login_token($token = false) {
-        global $CFG;
+        global $CFG, $SESSION;
 
         if (!empty($CFG->alternateloginurl) || !empty($CFG->disablelogintoken)) {
             // An external login page cannot generate the login token we need to protect CSRF on
@@ -1292,7 +1292,7 @@ class manager {
         $currenttoken = self::get_login_token();
 
         // We need to clean the login token so the old one is not valid again.
-        self::create_login_token();
+        unset($SESSION->logintoken);
 
         if ($currenttoken !== $token) {
             // Fail the login.