tml_admin_save_ms_settings()

function tml_admin_save_ms_settings() {

    if ( ! tml_is_post_request() ) {
        return;
    }

    // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- the nonce action name below is derived from $option_page itself, so it must be read before check_admin_referer() can run; verified two lines down.
    $option_page = ! empty( $_REQUEST['option_page'] ) ? $_REQUEST['option_page'] : '';

    if ( empty( $option_page ) || ! theme_my_login_admin()->has_page( $option_page ) ) {
        return;
    }

    check_admin_referer( $option_page . '-options' );

    /** This filter is documented in wp-admin/options.php */
    $whitelist_options = apply_filters( 'whitelist_options', array() );

    /* This filter is documented in wp-admin/options.php */
    $allowed_options = apply_filters( 'allowed_options', $whitelist_options );

    if ( ! isset( $allowed_options[ $option_page ] ) ) {
        wp_die(
            sprintf(
                /* translators: %s: The options page name. */
                __( '<strong>Error:</strong> The %s options page is not in the allowed options list.' ), // phpcs:ignore WordPress.WP.I18n.MissingArgDomain, WordPress.Security.EscapeOutput.OutputNotEscaped -- reusing WP core's translated error string verbatim (see wp-admin/options.php); the dynamic value is already esc_html()'d below.
                '<code>' . esc_html( $option_page ) . '</code>'
            )
        );
    }

    foreach ( $allowed_options[ $option_page ] as $option ) {
        $option = trim( $option );
        $value  = null;
        if ( isset( $_POST[ $option ] ) ) {
            $value = $_POST[ $option ];
            if ( ! is_array( $value ) ) {
                $value = trim( $value );
            }
            $value = wp_unslash( $value );
        }

        // update_site_option() skips sanitize_option(), unlike update_option() — apply it explicitly.
        $value = sanitize_option( $option, $value );

        update_site_option( $option, $value );
    }

    tml_flush_rewrite_rules();

    if ( ! count( get_settings_errors() ) ) {
        add_settings_error( 'general', 'settings_updated', __( 'Settings saved.' ), 'updated' ); // phpcs:ignore WordPress.WP.I18n.MissingArgDomain -- reusing WP core's translated "Settings saved." string, not a TML-specific string.
    }
    set_transient( 'settings_errors', get_settings_errors(), 30 );

    $goback = add_query_arg( 'settings-updated', 'true', wp_get_referer() );
    wp_safe_redirect( $goback );
    exit;
}

View src/admin/settings.php, line 699 on GitHub