CSRF protection for the login form. The authenticate_user_login function was
extended to validate the token (in \core\session\manager) but by default it
does not perform the extra validation. Existing uses of this function from
auth plugins and features like "change password" will continue to work without
changes. New config value $CFG->disablelogintoken can bypass this check.
Significant string changes:
* withselectedusers_help, core - removing mention of 'Add a common note'
as the option no longer exists
* considereddigitalminor and digitalminor_desc, core - more
child-friendly wording
* configmessagingallusers, core_admin - clearer explanation
* auth_dbtype, auth_db - fixed broken link
Significant string changes:
* completionpass_help, gradetopassnotset in mod_quiz - grade to pass set
in quiz settings not gradebook
* namecolumnmissing,core_cohort - fixing incorrect message about adding
users to a cohort
This reduces the amount of code to an already confusing logout.php
file and prevents conflicts if someone else happens to be using
the same function name in a file.
* Use the Moodle 2+ {sessions} table, and decode the session
correctly using session_decode (adodb_unserialize is deprecated).
* Kill all user sessions using \core\session\manager's
kill_user_sessions.
The output strings for the Test Settings function were hard-coded English
strings. They've been changed to standard language strings which can be
translated and maintained via AMOS.
Significant string changes:
* publishstate_help, core_notes - including GDPR guidance
* contactdataprotectionofficer_desc, tool_dataprivacy - removing mention
of link on privacy policy page as it is not yet implemented