CSecurityUser::onBeforeUserLogin

static function onBeforeUserLogin(&$arParams)
{
	//compatibility with old forms
	if (
		$arParams['PASSWORD_ORIGINAL'] === 'Y'
		&& preg_match('/(d{6})$/D', $arParams["PASSWORD"], $arMatch)
	)
	{
		$arParams['OTP'] = $arMatch[1];
	}
	
	return true;
}