Sanitize key parameter in activation flow to enhance security

[khushipatel15]

Currently, the key parameter received via $_GET or $_POST is used directly without sanitization in the activation flow. This patch introduces the use of sanitize_text_field() when retrieving the key from user input to ensure the data is cleaned before further processing.

Changes made:
Added sanitize_text_field() for both $_GETkey? and $_POSTkey? when assigning the $key variable.
This ensures that any potentially unsafe characters are stripped out, reducing the risk of unexpected behavior or misuse.

[khushipatel15]

This Patch file shows enhancement and use of sanitize key and meets coding standards of wordpress.

[narenin]

Welcome to the core trac @khushipatel15

The PR looks good to me but we should add space after opening ( and closing of ) as per PHPCS coding standards so

sanitize_text_field($_GET['key'])

Should be

sanitize_text_field( $_GET['key'] )

[khushipatel15]

Thankyou so much for the suggestion, I'll update it soon.

[khushipatel15]

Here is the updated patch file.

[narenin]

Thanks for the changes, looks good to me.

[flixos90]

Thanks @khushipatel15 for reporting this!

It surely looks worth doing, but some of the focus areas here are not really relevant, so I'm going to remove them.

This simply ports over https://core.trac.wordpress.org/attachment/ticket/63320/63320.2.patch.

Trac ticket: https://core.trac.wordpress.org/ticket/63320

[flixos90]

In 60204:

Networks and Sites: Sanitize key parameter in wp-activate.php.

Props khushipatel15.
Fixes #63320.

[siliconforks]

I notice that wp-activate.php also looks for an activation key in $_COOKIE:

​https://github.com/WordPress/wordpress-develop/blob/843e4860dd90f47b668567b851b34cd8f3dd8f65/src/wp-activate.php#L50