tml_ms_filter_signup_shortcode()

function tml_ms_filter_signup_shortcode( $content = '', $action = 'signup', $atts = array() ) { // phpcs:ignore Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed -- kept for API/documented-signature consistency with the other shortcode-filter callbacks in this file.
    if ( 'signup' !== $action ) {
        return $content;
    }

    $content = '';

    $active_signup = tml_ms_signup_get_active_signup();

    // phpcs:disable WordPress.WP.I18n.MissingArgDomain, WordPress.WP.I18n.MissingTranslatorsComment, WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended -- these messages intentionally reuse WP core's translated wp-signup.php strings verbatim, not TML-specific strings, and this whole block is read-only rendering of the current signup stage/fields mirroring wp-signup.php's own unauthenticated signup form output, which has no nonce. (A single combined disable is used instead of nesting separate ones per sniff, since nested phpcs:disable/enable pairs for different sniff codes have been observed to corrupt phpcs's suppression tracking for the rest of the file.)
    if ( current_user_can( 'manage_network' ) ) {
        $content .= '<div class="tml-messages">' . __( 'Greetings Network Administrator!' ) . ' ';
        switch ( $active_signup ) {
            case 'none':
                $content .= __( 'The network currently disallows registrations.' );
                break;

            case 'blog':
                $content .= __( 'The network currently allows site registrations.' );
                break;

            case 'user':
                $content .= __( 'The network currently allows user registrations.' );
                break;

            default:
                $content .= __( 'The network currently allows both site and user registrations.' );
                break;
        }
        $content .= ' ' . sprintf(
            __( 'To change or disable registration go to your <a href="%s">Options page</a>.' ),
            esc_url( network_admin_url( 'settings.php' ) )
        );
        $content .= '</div>';
    }

    $newblogname = isset( $_GET['new'] ) ? strtolower( preg_replace( '/^-|-$|[^-a-zA-Z0-9]/', '', $_GET['new'] ) ) : null;

    if ( 'none' === $active_signup ) {
        $content .= __( 'Registration has been disabled.' );
    } elseif ( 'blog' === $active_signup && ! is_user_logged_in() ) {
        $content .= sprintf(
            __( 'You must first <a href="%s">log in</a>, and then you can create a new site.' ),
            wp_login_url( network_site_url( 'wp-signup.php' ) )
        );
    } else {
        $stage = isset( $_POST['stage'] ) ? $_POST['stage'] : 'default';
        switch ( $stage ) {
            case 'validate-user-signup':
                if ( 'all' === $active_signup
                    || ( 'blog' === $_POST['signup_for'] && 'blog' === $active_signup )
                    || ( 'user' === $_POST['signup_for'] && 'user' === $active_signup )
                ) {
                    $result = tml_get_data( 'signup_result' );
                    $form   = tml_get_data( 'signup_form' );
                    if ( 'user' === $form ) {
                        $content .= tml_ms_get_user_signup_form( $result['user_name'], $result['user_email'], $result['errors'] );
                    } elseif ( 'blog' === $form ) {
                        $content .= tml_ms_get_blog_signup_form( $result['user_name'], $result['user_email'] );
                    } else {
                        $content .= '<h2>' . sprintf( __( '%s is your new username' ), tml_is_email_login_type() ? $result['user_email'] : $result['user_name'] ) . '</h2>';
                        $content .= '<p>' . __( 'But, before you can start using your new username, <strong>you must activate it</strong>.' ) . '</p>';
                        /* translators: %s: The user email address. */
                        $content .= '<p>' . sprintf( __( 'Check your inbox at %s and click on the given link.' ), '<strong>' . $result['user_email'] . '</strong>' ) . '</p>';
                        $content .= '<p>' . __( 'If you do not activate your username within two days, you will have to sign up again.' ) . '</p>';
                    }
                } else {
                    $content .= __( 'User registration has been disabled.' );
                }
                break;

            case 'validate-blog-signup':
                if ( 'all' === $active_signup || 'blog' === $active_signup ) {
                    $user_result = tml_get_data( 'signup_user_result' );
                    $blog_result = tml_get_data( 'signup_result' );
                    $form        = tml_get_data( 'signup_form' );
                    if ( 'user' === $form ) {
                        $content .= tml_ms_get_user_signup_form( $user_result['user_name'], $user_result['user_email'], $user_result['errors'] );
                    } elseif ( 'blog' === $form ) {
                        $content .= tml_ms_get_blog_signup_form( $user_result['user_name'], $user_result['user_email'], $blog_result['blogname'], $blog_result['blog_title'], $blog_result['errors'] );
                    } else {
                        $content .= '<h2>' . sprintf( __( 'Congratulations! Your new site, %s, is almost ready.' ), "<a href='http://{$blog_result['domain']}{$blog_result['path']}'>{$blog_result['blog_title']}</a>" ) . '</h2>';
                        $content .= '<p>' . __( 'But, before you can start using your site, <strong>you must activate it</strong>.' ) . '</p>';
                        /* translators: %s: The user email address. */
                        $content .= '<p>' . sprintf( __( 'Check your inbox at %s and click on the given link.' ), '<strong>' . $user_result['user_email'] . '</strong>' ) . '</p>';
                        $content .= '<p>' . __( 'If you do not activate your site within two days, you will have to sign up again.' ) . '</p>';
                        $content .= '<h2>' . __( 'Still waiting for your email?' ) . '</h2>';
                        /* translators: %s: The user email address. */
                        $content .= '<p>' .
                                __( 'If you have not received your email yet, there are a number of things you can do:' ) . '
                                <ul id="noemail-tips">
                                    <li><p><strong>' . __( 'Wait a little longer. Sometimes delivery of email can be delayed by processes outside of our control.' ) . '</strong></p></li>
                                    <li><p>' . __( 'Check the junk or spam folder of your email client. Sometime emails wind up there by mistake.' ) . '</p></li>
                                    <li>' . sprintf( __( 'Have you entered your email correctly? You have entered %s, if it&#8217;s incorrect, you will not receive your email.' ), $user_result['user_email'] ) . '</li>
                                </ul>
                            </p>';
                    }
                } else {
                    $content .= __( 'Site registration has been disabled.' );
                }
                break;

            case 'gimmeanotherblog':
                if ( 'all' !== $active_signup && 'blog' !== $active_signup ) {
                    $content .= __( 'Site registration has been disabled.' );
                    break;
                }

                $result = tml_get_data( 'signup_result' );
                $form   = tml_get_data( 'signup_form' );
                if ( 'another_blog' === $form ) {
                    $content .= tml_ms_get_another_blog_signup_form( $result['blogname'], $result['blog_title'], $result['errors'] );
                } else {
                    $blog_id = tml_get_data( 'signup_blog_id' );
                    if ( ! is_wp_error( $blog_id ) ) {
                        if ( $blog_id ) {
                            switch_to_blog( $blog_id );
                            $home_url  = home_url( '/' );
                            $login_url = wp_login_url();
                            restore_current_blog();
                        } else {
                            $home_url  = 'http://' . $result['domain'] . $result['path'];
                            $login_url = 'http://' . $result['domain'] . $result['path'] . 'wp-login.php';
                        }

                        $site = sprintf(
                            '<a href="%1$s">%2$s</a>',
                            esc_url( $home_url ),
                            $result['blog_title']
                        );

                        $content .= '<h2>' . sprintf( __( 'The site %s is yours.' ), $site ) . '</h2>';
                        $content .= sprintf(
                            __( '%1$s is your new site. <a href="%2$s">Log in</a> as &#8220;%3$s&#8221; using your existing password.' ),
                            sprintf(
                                '<a href="%s">%s</a>',
                                esc_url( $home_url ),
                                untrailingslashit( $result['domain'] . $result['path'] )
                            ),
                            esc_url( $login_url ),
                            wp_get_current_user()->user_login
                        );
                    }
                }
                break;

            case 'default':
            default:
                $user_email = isset( $_POST['user_email'] ) ? $_POST['user_email'] : '';

                do_action( 'preprocess_signup_form' );

                if ( is_user_logged_in() && ( 'all' === $active_signup || 'blog' === $active_signup ) ) {
                    $content .= tml_ms_get_another_blog_signup_form( $newblogname );
                } elseif ( ! is_user_logged_in() && ( 'all' === $active_signup || 'user' === $active_signup ) ) {
                    $content .= tml_ms_get_user_signup_form( $newblogname, $user_email );
                } elseif ( ! is_user_logged_in() && 'blog' === $active_signup ) {
                    $content .= __( 'Sorry, new registrations are not allowed at this time.' );
                } else {
                    $content .= __( 'You are logged in already. No need to register again!' );
                }

                if ( $newblogname ) {
                    $newblog = get_blogaddress_by_name( $newblogname );

                    if ( 'blog' === $active_signup || 'all' === $active_signup ) {
                        $content .= sprintf(
                            '<p><em>' . __( 'The site you were looking for, %s, does not exist, but you can create it now!' ) . '</em></p>',
                            '<strong>' . $newblog . '</strong>'
                        );
                    } else {
                        $content .= sprintf(
                            '<p><em>' . __( 'The site you were looking for, %s, does not exist.' ) . '</em></p>',
                            '<strong>' . $newblog . '</strong>'
                        );
                    }
                }
                break;
        }
    }
    // phpcs:enable WordPress.WP.I18n.MissingArgDomain, WordPress.WP.I18n.MissingTranslatorsComment, WordPress.Security.NonceVerification.Missing, WordPress.Security.NonceVerification.Recommended

    return $content;
}

View src/includes/ms-functions.php, line 767 on GitHub