tml_ms_activation_handler()

function tml_ms_activation_handler() {
    global $wp_object_cache;

    if ( ! defined( 'WP_INSTALLING' ) ) {
        define( 'WP_INSTALLING', true );
    }

    if ( ! is_multisite() ) {
        wp_redirect( wp_registration_url() ); // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- target is always wp_registration_url(), not user-controlled; matches wp-activate.php's own use of plain wp_redirect() here.
        exit;
    }

    if ( is_object( $wp_object_cache ) ) {
        $wp_object_cache->cache_enabled = false;
    }

    // phpcs:disable WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended -- mirrors wp-activate.php's own activation-key processing, which is a public unauthenticated request with no nonce (the key itself is the credential).
    if ( ! empty( $_GET['key'] ) || ! empty( $_POST['key'] ) ) {
        $key = ! empty( $_GET['key'] ) ? $_GET['key'] : $_POST['key'];

        if ( tml_allow_user_passwords() ) {
            $errors = tml_validate_new_user_password();
            if ( $errors->get_error_code() ) {
                tml_set_data( 'activation_result', $errors );
                return;
            }
            tml_set_data( 'activation_password', $_POST['user_pass1'] );
        }

        // Auto-login needs the activation form submitted, so show it instead.
        if ( tml_allow_auto_login() && ! tml_is_post_request() ) {
            return;
        }

        try {
            $result = wpmu_activate_signup( $key );
        } finally {
            // The chosen password applies only to the account just activated.
            tml_set_data( 'activation_password', '' );
        }

        if ( ! is_wp_error( $result ) ) {
            $activation_redirect = null;
            if ( tml_allow_user_passwords() ) {
                $activation_redirect = isset( $result['blog_id'] ) ? get_home_url( $result['blog_id'] ) : network_home_url();
            }

            /**
             * Filters the URL to redirect to after activation.
             *
             * @since 7.0
             *
             * @param string $url     The URL ro redirect to after activation.
             * @param int    $user_id The user ID.
             * @param int    $blog_id The blog ID.
             */
            $activation_redirect = apply_filters( 'tml_ms_activation_redirect', $activation_redirect, $result['user_id'], isset( $result['blog_id'] ) ? $result['blog_id'] : null );

            if ( ! empty( $activation_redirect ) ) {
                wp_safe_redirect( $activation_redirect );
                exit;
            }
        }

        tml_set_data( 'activation_result', $result );
    }
    // phpcs:enable WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
}

View src/includes/ms-functions.php, line 1195 on GitHub