This line I believe should use require_once and not require:

https://github.com/moodle/moodle/blob/1a33da66378c307e50b29f9a5f2a7d3888da8f09/login/confirm.php#L28

This is causing a fatal exception if a plugin defines an after_config hook that also require_once this file.

I don't see any reason for the require instead of require_once, and furthermore the docs https://moodledev.io/general/development/policies/codingstyle#require–include specify that config.php is the only file that should ever use require.

To recreate:

• Setup a site
• Have a plugin with an after_config hook which requires this file, e.g. you can hack mod/assign/lib.php:
  •  

    function assign_after_config() {

    global $CFG;

    require_once($CFG->dirroot . '/login/lib.php');

    }

     

• Purge site caches after adding above
• Navigate to /login/confirm.php
• Confirm you receive a fatal error **

  Fatal error: Cannot redeclare core_login_process_password_reset_request() (previously declared in /var/www/site/login/lib.php:41) in /var/www/site/login/lib.php on line 41