Skip to content

Fixes issue with incorrect urls in signup and activation flow for mul… #12257

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
hasukmistry wants to merge 6 commits into from
Closed

Fixes issue with incorrect urls in signup and activation flow for mul… #12257

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
1c59dbd
Fixes issue with incorrect urls in signup and activation flow for mul…
hasukmistry Jun 22, 2026
5406b49
Simplifies url buiilding, clean up and applies scheme-relative URL in…
hasukmistry Jun 30, 2026
18873af
Merge branch 'trunk' into ticket-65506
westonruter Jul 7, 2026
5ea677b
Add type definitions for variables to fix static analysis on changed …
westonruter Jul 7, 2026
025a271
Address related PHPStan errors in wp-activate.php and wpmu_activate_s…
westonruter Jul 7, 2026
6bc3caf
Remove description from var
westonruter Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions src/wp-activate.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,6 +117,7 @@ function wpmu_activate_stylesheet() {

get_header( 'wp-activate' );

/** @var WP_Site $blog_details */
$blog_details = get_site();
?>

Expand All @@ -138,6 +139,7 @@ function wpmu_activate_stylesheet() {
<?php
} else {
if ( is_wp_error( $result ) && in_array( $result->get_error_code(), $valid_error_codes, true ) ) {
/** @var object{ signup_id: string, domain: string, path: string, title: string, user_login: string, user_email: string, registered: string, activated: string, active: string, activation_key: string, meta: string|null } $signup */
$signup = $result->get_error_data();
?>
<h2><?php _e( 'Your account is now active!' ); ?></h2>
Expand All @@ -153,10 +155,12 @@ function wpmu_activate_stylesheet() {
esc_url( wp_lostpassword_url() )
);
} else {
$url = ( is_ssl() ? 'https://' : 'http://' ) . $signup->domain . $blog_details->path;

@westonruter westonruter Jul 7, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When analyzing at the changes in this PR with PHPStan, I found 3 errors:

  156    Binary operation "." between 'http://'|'https://' and mixed results in an error.
         🪪  binaryOp.invalid
  156    Cannot access property $domain on mixed.
         🪪  property.nonObject
  156    Cannot access property $path on WP_Site|null.
         🪪  property.nonObject

These are not introduced by this PR, but in the interest of cleaning such issues up as we go, I've added a couple commits to this PR to address type issues with the related code.


printf(
/* translators: 1: Site URL, 2: Username, 3: User email address, 4: Lost password URL. */
__( 'Your site at %1$s is active. You may now log in to your site using your chosen username of &#8220;%2$s&#8221;. Please check your email inbox at %3$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%4$s">reset your password</a>.' ),
sprintf( '<a href="http://%1$s">%1$s</a>', esc_url( $signup->domain . $blog_details->path ) ),
sprintf( '<a href="%1$s">%1$s</a>', esc_url( $url ) ),
esc_html( $signup->user_login ),
esc_html( $signup->user_email ),
esc_url( wp_lostpassword_url() )
Expand All @@ -171,7 +175,8 @@ function wpmu_activate_stylesheet() {
<?php endif; ?>
<?php
} else {
$url = isset( $result['blog_id'] ) ? esc_url( get_home_url( (int) $result['blog_id'] ) ) : '';
$url = isset( $result['blog_id'] ) ? esc_url( get_home_url( (int) $result['blog_id'] ) ) : '';
/** @var WP_User $user */
$user = get_userdata( (int) $result['user_id'] );
?>
<h2><?php _e( 'Your account is now active!' ); ?></h2>
Expand Down
25 changes: 21 additions & 4 deletions src/wp-includes/ms-functions.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1190,13 +1190,25 @@ function wpmu_signup_user_notification(
*
* @param string $key The activation key provided to the user.
* @return array|WP_Error An array containing information about the activated user and/or blog.
* @phpstan-return array{
* user_id: int,
* password: string,
* meta: array<string, mixed>,
* }|array{
* blog_id: int,
* user_id: int,
* password: string,
* title: string,
* meta: array<string, mixed>,
* }|WP_Error
*/
function wpmu_activate_signup(
#[\SensitiveParameter]
$key
) {
global $wpdb;

/** @var object{ signup_id: string, domain: string, path: string, title: string, user_login: string, user_email: string, registered: string, activated: string, active: string, activation_key: string, meta: string|null }|null $signup */
$signup = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM $wpdb->signups WHERE activation_key = %s", $key ) );

if ( empty( $signup ) ) {
Expand All @@ -1211,7 +1223,12 @@ function wpmu_activate_signup(
}
}

$meta = maybe_unserialize( $signup->meta );
if ( is_string( $signup->meta ) ) {
/** @var array<string, mixed> $meta */
$meta = maybe_unserialize( $signup->meta );
} else {
$meta = array();
}
$password = wp_generate_password( 12, false );

$user_id = username_exists( $signup->user_login );
Expand All @@ -1230,7 +1247,7 @@ function wpmu_activate_signup(

if ( empty( $signup->domain ) ) {
$wpdb->update(
$wpdb->signups,
(string) $wpdb->signups,
array(
'active' => 1,
'activated' => $now,
Expand Down Expand Up @@ -1272,7 +1289,7 @@ function wpmu_activate_signup(
if ( 'blog_taken' === $blog_id->get_error_code() ) {
$blog_id->add_data( $signup );
$wpdb->update(
$wpdb->signups,
(string) $wpdb->signups,
array(
'active' => 1,
'activated' => $now,
Expand All @@ -1284,7 +1301,7 @@ function wpmu_activate_signup(
}

$wpdb->update(
$wpdb->signups,
(string) $wpdb->signups,
array(
'active' => 1,
'activated' => $now,
Expand Down
2 changes: 1 addition & 1 deletion src/wp-signup.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -865,7 +865,7 @@ function confirm_blog_signup( $domain, $path, $blog_title, $user_name = '', $use
<h2>
<?php
/* translators: %s: Site address. */
printf( __( 'Congratulations! Your new site, %s, is almost ready.' ), "<a href='http://{$domain}{$path}'>{$blog_title}</a>" )
printf( __( 'Congratulations! Your new site, %s, is almost ready.' ), "<a href='//{$domain}{$path}'>{$blog_title}</a>" )
?>
</h2>

Expand Down
Loading