Changeset 62651 for trunk/src/wp-signup.php

Timestamp:

07/07/2026 03:05:44 AM (3 months ago)

Author:

westonruter

Message:

Login and Registration: Fix signup and activation URL schemes.

When an already-active signup is revisited, wp-activate.php hard-coded the http:// scheme and passed the scheme-less domain and path through esc_url(), which prepended its own http:// and produced a doubled, broken http://http:// link. Build the full URL with the correct scheme from is_ssl() before escaping it.

Additionally, the signup confirmation heading in wp-signup.php now uses a scheme-relative // URL so the link honors the network's HTTPS configuration instead of forcing http.

This also hardens related code in wp-activate.php and wpmu_activate_signup() against type issues surfaced by PHPStan, including normalizing the signup meta to always be an array.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/12257.
Follow-up to r12603, r48672, r57625.

Props meet_hasmukh, westonruter.
See #64898.
Fixes #65506.

File:

• trunk/src/wp-signup.php (modified) (1 diff)

trunk/src/wp-signup.php

@@ -866 +866 @@
         <?php
         /* translators: %s: Site address. */
-        printf( __( 'Congratulations! Your new site, %s, is almost ready.' ), "<a href='http://{$domain}{$path}'>{$blog_title}</a>" )
+        printf( __( 'Congratulations! Your new site, %s, is almost ready.' ), "<a href='//{$domain}{$path}'>{$blog_title}</a>" )
         ?>
         </h2>