Ticket #25350: 25350.04.patch

src/wp-activate.php

@@ -52 +52 @@
 add_action( 'wp_head', 'wpmu_activate_stylesheet' );
 
 get_header();
+
+//duplicate_hook
+$key_param = apply_filters( 'wp_activate_key_param', 'k' );
+
+$activation_key = false;
+if ( ! empty( $_REQUEST[ $key_param ] ) ) {
+        $activation_key = urldecode( $_GET[ $key_param ] );
+} else if ( ! empty( $_REQUEST['key'] ) ) {
+        // Backward compatibility
+        $activation_key = urldecode( $_REQUEST['key'] );
+}
+
 ?>
 
 <div id="content" class="widecolumn">
-        <?php if ( empty($_GET['key']) && empty($_POST['key']) ) { ?>
+        <?php if ( empty( $activation_key ) ) { ?>
 
                 <h2><?php _e('Activation Key Required') ?></h2>
                 <form name="activateform" id="activateform" method="post" action="<?php echo network_site_url('wp-activate.php'); ?>">
                         <p>
                             <label for="key"><?php _e('Activation Key:') ?></label>
-                            <br /><input type="text" name="key" id="key" value="" size="50" />
+                            <br /><input type="text" name="<?php echo esc_attr( $key_param ) ?>" id="key" value="" size="50" />
                         </p>
                         <p class="submit">
                             <input id="submit" type="submit" name="Submit" class="submit" value="<?php esc_attr_e('Activate') ?>" />
@@ -70 +82 @@
 
         <?php } else {
 
-                $key = !empty($_GET['key']) ? $_GET['key'] : $_POST['key'];
-                $result = wpmu_activate_signup($key);
+                $result = wpmu_activate_signup( $activation_key );
                 if ( is_wp_error($result) ) {
                         if ( 'already_active' == $result->get_error_code() || 'blog_taken' == $result->get_error_code() ) {
                             $signup = $result->get_error_data();
@@ -116 +127 @@
         var key_input = document.getElementById('key');
         key_input && key_input.focus();
 </script>
-<?php get_footer(); ?>
- No newline at end of file
+<?php get_footer(); ?>

src/wp-includes/ms-functions.php

@@ -714 +714 @@
         if ( !apply_filters('wpmu_signup_blog_notification', $domain, $path, $title, $user, $user_email, $key, $meta) )
                 return false;
 
+        /**
+         * Filter the URL parameter to use for activation keys
+         *
+         * @since 3.7.0
+         * @param string The activation key parameter.
+         */
+        $key_param = apply_filters( 'wp_activate_key_param', 'k' );
+
         // Send email with activation link.
         if ( !is_subdomain_install() || $current_site->id != 1 )
-                $activate_url = network_site_url("wp-activate.php?key=$key");
+                $activate_url = network_site_url("wp-activate.php?$key_param=$key");
         else
-                $activate_url = "http://{$domain}{$path}wp-activate.php?key=$key"; // @todo use *_url() API
+                $activate_url = "http://{$domain}{$path}wp-activate.php?$key_param=$key"; // @todo use *_url() API
 
         $activate_url = esc_url($activate_url);
         $admin_email = get_site_option( 'admin_email' );
@@ -773 +781 @@
         if ( !apply_filters('wpmu_signup_user_notification', $user, $user_email, $key, $meta) )
                 return false;
 
+        //duplicate_hook
+        $key_param = apply_filters( 'wp_activate_key_param', 'k' );
+
         // Send email with activation link.
         $admin_email = get_site_option( 'admin_email' );
         if ( $admin_email == '' )
@@ -784 +795 @@
                         __( "To activate your user, please click the following link:\n\n%s\n\nAfter you activate, you will receive *another email* with your login." ),
                         $user, $user_email, $key, $meta
                 ),
-                site_url( "wp-activate.php?key=$key" )
+                site_url( "wp-activate.php?$key_param=$key" )
         );
         // TODO: Don't hard code activation link.
         $subject = sprintf(