Piwik\Plugins\Login\PasswordResetter::isTokenValid PHP Method

    public function isTokenValid($token, $user)
    {
        $now = time();
        // token valid for 24 hrs (give or take, due to the coarse granularity in our strftime format string)
        for ($i = 0; $i <= 24; $i++) {
            $generatedToken = $this->generatePasswordResetToken($user, $now + $i * 60 * 60);
            if ($generatedToken === $token) {
                return true;
            }
        }
        // fails if token is invalid, expired, password already changed, other user information has changed, ...
        return false;
    }