Ticket #25350: 25350.03.patch

src/wp-activate.php

@@ -52 +52 @@
 add_action( 'wp_head', 'wpmu_activate_stylesheet' );
 
 get_header();
+
+$key_param = wp_activation_key_param();
+$get_activation_key = false;
+if ( ! empty( $_GET[ $key_param ] ) ) {
+        $get_activation_key = urldecode( $_GET[ $key_param ] );
+} else if ( ! empty( $_GET['key'] ) ) {
+        // Backward compatibility
+        $get_activation_key = urldecode( $_GET['key'] );
+}
+
 ?>
 
 <div id="content" class="widecolumn">
-        <?php if ( empty($_GET['key']) && empty($_POST['key']) ) { ?>
+        <?php if ( empty( $get_activation_key ) && empty($_POST['key']) ) { ?>
 
                 <h2><?php _e('Activation Key Required') ?></h2>
                 <form name="activateform" id="activateform" method="post" action="<?php echo network_site_url('wp-activate.php'); ?>">
@@ -70 +80 @@
 
         <?php } else {
 
-                $key = !empty($_GET['key']) ? $_GET['key'] : $_POST['key'];
+                $key = ! empty( $get_activation_key ) ? $get_activation_key : $_POST['key'];
                 $result = wpmu_activate_signup($key);
                 if ( is_wp_error($result) ) {
                         if ( 'already_active' == $result->get_error_code() || 'blog_taken' == $result->get_error_code() ) {
@@ -116 +126 @@
         var key_input = document.getElementById('key');
         key_input && key_input.focus();
 </script>
-<?php get_footer(); ?>
- No newline at end of file
+<?php get_footer(); ?>

src/wp-includes/ms-functions.php

@@ -714 +714 @@
         if ( !apply_filters('wpmu_signup_blog_notification', $domain, $path, $title, $user, $user_email, $key, $meta) )
                 return false;
 
+        $key_param = wp_activation_key_param();
+
         // Send email with activation link.
         if ( !is_subdomain_install() || $current_site->id != 1 )
-                $activate_url = network_site_url("wp-activate.php?key=$key");
+                $activate_url = network_site_url("wp-activate.php?$key_param=$key");
         else
-                $activate_url = "http://{$domain}{$path}wp-activate.php?key=$key"; // @todo use *_url() API
+                $activate_url = "http://{$domain}{$path}wp-activate.php?$key_param=$key"; // @todo use *_url() API
 
         $activate_url = esc_url($activate_url);
         $admin_email = get_site_option( 'admin_email' );
@@ -773 +775 @@
         if ( !apply_filters('wpmu_signup_user_notification', $user, $user_email, $key, $meta) )
                 return false;
 
+        $key_param = wp_activation_key_param();
+
         // Send email with activation link.
         $admin_email = get_site_option( 'admin_email' );
         if ( $admin_email == '' )
@@ -784 +788 @@
                         __( "To activate your user, please click the following link:\n\n%s\n\nAfter you activate, you will receive *another email* with your login." ),
                         $user, $user_email, $key, $meta
                 ),
-                site_url( "wp-activate.php?key=$key" )
+                site_url( "wp-activate.php?$key_param=$key" )
         );
         // TODO: Don't hard code activation link.
         $subject = sprintf(
@@ -2059 +2063 @@
 
         return $site_results;
 }
+
+/**
+ * Return the URL parameter to use for activation keys
+ *
+ * @since 3.7.0
+ *
+ * @return string The activation key paramater. Defaults to 'k'.
+ */
+function wp_activation_key_param() {
+        /**
+         * Filter the URL parameter to use for activation keys
+         *
+         * @since 3.7.0
+         * @param string The activation key parameter.
+         */
+        return urlencode( apply_filters( 'wp_activation_key_param', 'k' ) );
+}