tml_ms_filter_activation_shortcode()

function tml_ms_filter_activation_shortcode( $content = '', $action = 'signup', $atts = array() ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed -- kept for API/documented-signature consistency with the other shortcode-filter callbacks in this file.
    if ( 'activate' !== $action ) {
        return $content;
    }

    $content = '';

    // phpcs:disable WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended -- mirrors wp-activate.php's own activation-key processing, which is a public unauthenticated request with no nonce (the key itself is the credential).
    // phpcs:disable WordPress.WP.I18n.MissingArgDomain, WordPress.WP.I18n.MissingTranslatorsComment -- these messages intentionally reuse WP core's translated wp-activate.php strings verbatim, not TML-specific strings; no translators comments since they never enter TML's own .pot.
    if ( ! tml_get_data( 'activation_result' ) ) {
        $content .= tml_get_form( 'activate' )->render(
            array(
                'before' => '<h2>' . __( 'Activation Key Required' ) . '</h2>',
            )
        );
    } else {
        $result = tml_get_data( 'activation_result' );
        if ( is_wp_error( $result ) ) {
            if ( 'already_active' === $result->get_error_code() || 'blog_taken' === $result->get_error_code() ) {
                $signup = $result->get_error_data();

                $content .= '<h2>' . __( 'Your account is now active!' ) . '</h2>';
                $content .= '<p class="lead-in">';
                if ( '' === $signup->domain . $signup->path ) {
                    $content .= sprintf(
                        __( 'Your account has been activated. You may now <a href="%1$s">log in</a> to the site using your chosen username of &#8220;%2$s&#8221;. Please check your email inbox at %3$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%4$s">reset your password</a>.' ),
                        network_site_url( 'wp-login.php', 'login' ),
                        $signup->user_login,
                        $signup->user_email,
                        wp_lostpassword_url()
                    );
                } else {
                    $content .= sprintf(
                        __( 'Your site at %1$s is active. You may now log in to your site using your chosen username of &#8220;%2$s&#8221;. Please check your email inbox at %3$s for your password and login instructions. If you do not receive an email, please check your junk or spam folder. If you still do not receive an email within an hour, you can <a href="%4$s">reset your password</a>.' ),
                        sprintf( '<a href="http://%1$s">%1$s</a>', $signup->domain ),
                        $signup->user_login,
                        $signup->user_email,
                        wp_lostpassword_url()
                    );
                }
                $content .= '</p>';
            } elseif ( tml_allow_user_passwords() && strpos( $result->get_error_code(), 'password' ) !== false ) {
                $form = tml_get_form( 'activate' );

                if ( isset( $_POST['user_pass1'] ) && isset( $_POST['user_pass2'] ) ) {
                    $form->set_errors( $result );
                }

                $content .= $form->render(
                    array(
                        'before' => '<h2>' . __( 'New Password' ) . '</h2>',
                    )
                );
            } else {
                $content .= '<h2>' . __( 'An error occurred during the activation' ) . '</h2>';
                $content .= '<p>' . $result->get_error_message() . '</p>';
            }
        } else {
            $url  = isset( $result['blog_id'] ) ? get_home_url( (int) $result['blog_id'] ) : '';
            $user = isset( $result['user_id'] ) ? get_userdata( (int) $result['user_id'] ) : false;

            $content .= '<h2>' . __( 'Your account is now active!' ) . '</h2>';

            $content .= '<div id="signup-welcome">';
            $content .= '<p><span class="h3">' . __( 'Username:' ) . '</span> ' . ( tml_is_default_registration_type() ? $user->user_login : $user->user_email ) . '</p>';
            $content .= '<p><span class="h3">' . __( 'Password:' ) . '</span> ' . ( tml_allow_user_passwords() ? '****' : $result['password'] ) . '</p>';
            $content .= '</div>';

            if ( $url && network_home_url( '', 'http' ) !== $url ) {
                switch_to_blog( (int) $result['blog_id'] );
                $login_url = wp_login_url();
                restore_current_blog();

                $content .= '<p class="view">';
                $content .= sprintf( __( 'Your account is now activated. <a href="%1$s">View your site</a> or <a href="%2$s">Log in</a>' ), $url, esc_url( $login_url ) );
                $content .= '</p>';
            } else {
                $content .= '<p class="view">';
                $content .= sprintf( __( 'Your account is now activated. <a href="%1$s">Log in</a> or go back to the <a href="%2$s">homepage</a>.' ), network_site_url( 'wp-login.php', 'login' ), network_home_url() );
                $content .= '</p>';
            }
        }
    }
    // phpcs:enable WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended
    // phpcs:enable WordPress.WP.I18n.MissingArgDomain, WordPress.WP.I18n.MissingTranslatorsComment

    return $content;
}

View src/includes/ms-functions.php, line 1285 on GitHub