Check the nonce before running login procedure, must use a hook lower than 20 (ad hijack).
@return void / bool
550546
public function validateNonce($username)
    {
        if (isset($_POST) && is_array($_POST) && !empty($_POST)) {

            if (isset($_POST['_ad_nonce'])) {
                if ($_POST['_ad_nonce'] == $this->generateFakeNonce()) {
                    return true;
                }
            }

            wp_die(__("Could not verify this logins origin. <a href='/wp-login.php'>Please try again.</a>", 'adintegration'));
        }
    }
33087
function isLogin()
    {
        if (isset($_SESSION[self::$session_prefix . 'isLogin']) and $_SESSION[self::$session_prefix . 'isLogin'] == 1)
        {
            return true;
        }
        return false;
    }
305498
public function loginAction() {
        // Do not cache login page
        $this->_helper->cache->setNoCacheHeaders($this->getResponse());

        $this->view->title = __('login page title');
        $this->view->description = __('login page description');

        // allow callers to set a targetUrl via the request
        if ($targetUrl = $this->_getSubmittedTargetUrl()) {
            Garp_Auth::getInstance()->getStore()->targetUrl = $targetUrl;
        }

        $authVars = Garp_Auth::getInstance()->getConfigValues();
        // self::processAction might have populated 'errors' and/or 'postData'
        if ($this->getRequest()->getParam('errors')) {
            $this->view->errors = $this->getRequest()->getParam('errors');
        }
        if ($this->getRequest()->getParam('postData')) {
            $this->view->postData = $this->getRequest()->getParam('postData');
        }
    }
701078
public function isSignInLocked()
    {
        $nb_session = $this->nb_application->getSession();
        if ($nb_session === null || !($nb_session instanceof CNabuHTTPSession)) {
            throw new ENabuCoreException(ENabuCoreException::ERROR_SESSION_NOT_FOUND);
        }

        $nb_site = $this->nb_application->getHTTPServer()->getSite();
        if ($nb_site === null || !($nb_site instanceof CNabuSite)) {
            throw new ENabuCoreException(ENabuCoreException::ERROR_SITE_NOT_FOUND);
        }

        $max_signin_retries = $nb_site->getMaxSignInRetries();
        $signin_locked_delay = $nb_site->getSignInLockDelay();
        $signin_retries = $nb_session->getVariable('signin_retries', 0);
        $signin_last_fail_timestamp = $nb_session->getVariable('signin_last_fail_timestamp', 0);
        $now = time() - $signin_last_fail_timestamp;

        if ($now > $signin_locked_delay) {
            $this->resetSignInLock();
            $retval = false;
        } else {
            $retval = $max_signin_retries > 0 && $signin_retries >= $max_signin_retries && $now < $signin_locked_delay;
        }

        return $retval;
    }
189297
function loginpage_hook() {
        global $CFG, $SESSION;

        // HTTPS is potentially required
        //httpsrequired(); - this must be used before setting the URL, it is already done on the login/index.php

        if (($_SERVER['REQUEST_METHOD'] === 'GET'         // Only on initial GET of loginpage
             || ($_SERVER['REQUEST_METHOD'] === 'POST'
                 && (get_local_referer() != strip_querystring(qualified_me()))))
                                                          // Or when POSTed from another place
                                                          // See MDL-14071
            && !empty($this->config->ntlmsso_enabled)     // SSO enabled
            && !empty($this->config->ntlmsso_subnet)      // have a subnet to test for
            && empty($_GET['authldap_skipntlmsso'])       // haven't failed it yet
            && (isguestuser() || !isloggedin())           // guestuser or not-logged-in users
            && address_in_subnet(getremoteaddr(), $this->config->ntlmsso_subnet)) {

            // First, let's remember where we were trying to get to before we got here
            if (empty($SESSION->wantsurl)) {
                $SESSION->wantsurl = null;
                $referer = get_local_referer(false);
                if ($referer &&
                        $referer != $CFG->wwwroot &&
                        $referer != $CFG->wwwroot . '/' &&
                        $referer != $CFG->wwwroot . '/login/' &&
                        $referer != $CFG->wwwroot . '/login/index.php') {
                    $SESSION->wantsurl = $referer;
                }
            }

            // Now start the whole NTLM machinery.
            if($this->config->ntlmsso_ie_fastpath == AUTH_NTLM_FASTPATH_YESATTEMPT ||
                $this->config->ntlmsso_ie_fastpath == AUTH_NTLM_FASTPATH_YESFORM) {
                if (core_useragent::is_ie()) {
                    $sesskey = sesskey();
                    redirect($CFG->wwwroot.'/auth/ldap/ntlmsso_magic.php?sesskey='.$sesskey);
                } else if ($this->config->ntlmsso_ie_fastpath == AUTH_NTLM_FASTPATH_YESFORM) {
                    redirect($CFG->wwwroot.'/login/index.php?authldap_skipntlmsso=1');
                }
            }
            redirect($CFG->wwwroot.'/auth/ldap/ntlmsso_attempt.php');
        }

        // No NTLM SSO, Use the normal login page instead.

        // If $SESSION->wantsurl is empty and we have a 'Referer:' header, the login
        // page insists on redirecting us to that page after user validation. If
        // we clicked on the redirect link at the ntlmsso_finish.php page (instead
        // of waiting for the redirection to happen) then we have a 'Referer:' header
        // we don't want to use at all. As we can't get rid of it, just point
        // $SESSION->wantsurl to $CFG->wwwroot (after all, we came from there).
        if (empty($SESSION->wantsurl)
            && (get_local_referer() == $CFG->wwwroot.'/auth/ldap/ntlmsso_finish.php')) {

            $SESSION->wantsurl = $CFG->wwwroot;
        }
    }
234336
public function redirectNotLogged()
    {
        // TODO: only if GET request!
        http_response_code(403);
        header("Location:".ROOT_URL.$this->loginPageUrl."?".$this->redirectParameter."=".urlencode($_SERVER['REQUEST_URI']));
        exit;
    }
196185
protected function isValidLoginRequest()
    {
        $check_hash = $this->queryParameters->get('hash');

        // Get sorted array of values
        $check = $this->queryParameters
            ->except('hash')
            ->map(function ($value, $key) {
                return $key.'='.$value;
            })
            ->values()
            ->sort();
        $check_string = implode("\n", $check->toArray());

        $secret = hash('sha256', $this->config->get('token'), true);
        $hash = hash_hmac('sha256', $check_string, $secret);

        if (strcmp($hash, $check_hash) !== 0) {
            return false;
        }
        if ((time() - $this->queryParameters->get('auth_date')) > 86400) {
            return false;
        }

        return true;
    }
922512
public function beforeExecuteRoute() {
        $this->validateServicesDefined();
        $this->getDi()->set('Request', $this->request);
        $this->setStatusCode(200);
        $this->setOutputObject(new \stdClass());
        $this->response->setHeader('Access-Control-Allow-Origin', '*');
        try {
            $this->validateLogin();
        } catch(Exception $e) {
            $this->handleError($e);
            $this->afterExecuteRoute();
            exit;
        }
    }
816608
public function onBeforeWrite()
    {
        if (!$this->owner->MFAEnabled && SiteConfig::current_site_config()->ForceMFA) {
            $this->owner->MFAEnabled = true;
            $this->owner->updateMFA = true;
        }
        if (!$this->owner->BackupCodeSalt || $this->owner->updateMFA) {
            $algorithm = Security::config()->get('password_encryption_algorithm');

            $encryptor = PasswordEncryptor::create_for_algorithm($algorithm);

            // No password. It's not even used in the salt generation
            $this->owner->BackupCodeSalt = $encryptor->salt('');
        }
    }
1303603
function onBeforeSecurityLogin()
    {
        $site = Multisites::inst()->getCurrentSite();

        if ($site && $site->Theme) {
            SSViewer::set_themes([$site->Theme, SSViewer::DEFAULT_THEME]);
        }
    }
147547
public function forceAuthentication()
    {
        if (self::isAuthenticated()) {
            return true;
        } elseif ($this->getTicket()) {
            return $this->validateCas();
        }
        session_write_close();
        $this->redirectToCas();
        // never reached
        return true;
    }
278311
private function checkIdentity(){
        if(isset($_SESSION['REMOTE_ADDR']) && isset($_SESSION['HTTP_USER_AGENT'])){            
            if($_SESSION['REMOTE_ADDR'] != $this->serverVars['REMOTE_ADDR'] || $_SESSION['HTTP_USER_AGENT'] != $this->serverVars['HTTP_USER_AGENT']) {
                Error::general_error('Session - Identity', 'There are a problem with the Sesion identity');
                exit;
            }
        }
        else{
            $_SESSION['REMOTE_ADDR'] = $this->serverVars['REMOTE_ADDR'];
            $_SESSION['HTTP_USER_AGENT'] = $this->serverVars['HTTP_USER_AGENT'];            
        }
    }
1338792
private static function validate() {
	if (self::is_active() == false) {
		$exception = bootstrap::get_library('exception');
		throw new $exception('inactive session');
	}
	
	if (empty($_SESSION['_session_type']) || empty($_SESSION['_session_last_active'])) {
		return false;
	}
	
	// throw away expired (replaced) sessions
	if (!empty($_SESSION['_session_expire_at']) && $_SESSION['_session_expire_at'] < time()) {
		return false;
	}
	
	// last_active short enough ago
	$type_duration = self::$type_durations[ $_SESSION['_session_type'] ];
	$active_enough = ($_SESSION['_session_last_active'] > (time() - $type_duration));
	if ($active_enough == false) {
		return false;
	}
	
	return true;
}
1120672
public function __isAllowed()
    {
        if ($this->checkAuthentication !== true) {
            // this controller is not responsible for the authentication
            return false;
        }

        $this->typo3Loader->initializeBackendEndUser();

        $beUser = $this->typo3Loader->getBackEndUser();
        if (false === is_array($beUser->user) || empty($beUser->user['uid'])) {
            return false;
        }
        return true;
    }
564169
public static function CheckAuthentication(){
            $oThis = self::CreateInstanceIfNotExists();
            $bReturn = ($oThis->bStarted) ? (!empty($oThis->aAuth["id"]) && !empty($oThis->aAuth["username"]) && ((intval($oThis->aAuth["timeout"]) > time()) || (intval($oThis->aAuth["timeout"]) <= 0))) : false;
            return $bReturn;
        }
631698
protected static function check_security() {
        global $CFG;

        if (!empty($_SESSION['USER']->id) and !empty($CFG->tracksessionip)) {
            // Make sure current IP matches the one for this session.
            $remoteaddr = getremoteaddr();

            if (empty($_SESSION['USER']->sessionip)) {
                $_SESSION['USER']->sessionip = $remoteaddr;
            }

            if ($_SESSION['USER']->sessionip != $remoteaddr) {
                // This is a security feature - terminate the session in case of any doubt.
                self::terminate_current();
                throw new exception('sessionipnomatch2', 'error');
            }
        }
    }
131762
public function login_noredirect()
    {
        $blAgb = \OxidEsales\Eshop\Core\Registry::getConfig()->getRequestParameter('ord_agb');

        if ($this->getParent()->isEnabledPrivateSales() && $blAgb !== null && ($oUser = $this->getUser())) {
            if ($blAgb) {
                $oUser->acceptTerms();
            }
        } else {
            $this->login();

            if (!$this->isAdmin() && !\OxidEsales\Eshop\Core\Registry::getConfig()->getConfigParam('blPerfNoBasketSaving')) {
                //load basket from the database
                try {
                    if ($oBasket = $this->getSession()->getBasket()) {
                        $oBasket->load();
                    }
                } catch (Exception $oE) {
                    //just ignore it
                }
            }
        }
    }