[wp-trac] [WordPress Trac] #39311: New user activation welcome page links to the wrong site

[WordPress Trac]

#39311: New user activation welcome page links to the wrong site
------------------------------------+-----------------------------
 Reporter:  tmoore41                |      Owner:
     Type:  defect (bug)            |     Status:  new
 Priority:  normal                  |  Milestone:  Awaiting Review
Component:  Login and Registration  |    Version:  4.7
 Severity:  normal                  |   Keywords:
  Focuses:  multisite               |
------------------------------------+-----------------------------
 I am having a problem with the welcome page that new users are shown after
 they have clicked on the link to activate their account.

 I am using multisite, and I am adding users from within one of the child
 sites, not from the network site.

 On the welcome page that shows the username and password there are links
 to go to the site or to login to the site. However, these links go to the
 network site, not to the child site. New users get confused because they
 are taken to a login page for a site (the network site) that they don’t
 have permission to access.

 I looked in to the code in `wp-activate.php` to see what is happening to
 cause this. It seems that at line 128 there is a check to see what blog to
 link to:

 {{{
 $url = isset( $result['blog_id'] ) ? get_home_url( (int)
 $result['blog_id'] ) : '';

 }}}

 `$result` is what comes back from the `wpmu_activate_signup` function. If
 `blog_id` is not set then there the home url does not get set, and then
 the network url is used. It looks like in my case the `blog_id` is not
 getting set.

 I then took a look in `wpmu_activate_signup` to see why the `blog_id` was
 not getting set. That turned up line 1020:

 {{{
 return array( 'user_id' => $user_id, 'password' => $password, 'meta' =>
 $meta );
 }}}

 where as you can see the `blog_id` isn’t set. However, the blog id is
 available in `$meta['add_to_blog]`. So I tried changing this line to

 {{{
 return array( 'user_id' => $user_id, 'password' => $password, 'meta' =>
 $meta, 'blog_id' => $meta['add_to_blog'] );
 }}}

 and now `wp-activate.php` sets the links correctly and the welcome page
 works as expected.

 Is this behaviour expected (bug or feature)?  Can it be fixed so that
 users do not get links that lead them to blogs that they have no access
 to?

--
Ticket URL: <https://core.trac.wordpress.org/ticket/39311>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform