Wrong password on confirmation page after manual activation of additional sub sites

[joelcj91]

In a multisite installation, we use wp-activate.php to activate a site using an activation key. Normally when users can register multiple sites using the same account, we ask them to manually click on activation link from email only once (on initial registration). Sometimes when we decide to enable manual activation for all new sites (even if the user has another site registered already), wp-activate.php will show wrong login credentials on the confirmation page. This is because wpmu_activate_signup returns newly generated password which was not used as the user account already exists.

I think currently it is not possible to enable manual activation for additional sites from WordPress without using custom plugin/code. But sometimes when we require this feature, WordPress will show a wrong password on the confirmation page, which will confuse the user.

On the above screenshot, the password was wrong as the user protest already exist, but WordPress generated a new password. The new password was generated to use if new user account is being created. But in this case, user account was not created. See wp-includes/ms-functions.php line #1031.

[joelcj91]

Let wp-activate.php know that if user was created or not

[realloc]

@joelcj91 We'd need to refresh against trunk - the diff is against r42080 (~4.8). Current trunk already uses esc_html(), so the conditional must keep that escaping.

When manual activation is enabled for additional site signups on a Multisite network (so a user who already has one site is required to confirm before an additional site is created), wpmu_activate_signup() still generates a brand-new password for the (already-registered) user and returns it in the result array. wp-activate.php then displays that freshly generated password on the confirmation page, even though it was never actually applied to the existing account — logging in with it fails and the user is confused about their real password.

This PR has wpmu_activate_signup() track whether the user already existed (it already computed this locally to decide whether to create a new user) and exposes it via a new user_already_exists key in the returned array. When the user already existed, the password key is now an empty string instead of the misleading generated one. wp-activate.php uses the new flag to show a message pointing the user at their existing username and password instead of a bogus one.

## Use of AI Tools

AI assistance: Yes
Tool(s): Claude Code
Model(s): Claude Sonnet 5
Used for: Implementation, tests, and PR description. Reviewed by Igor Rozum.