tml_registration_handler()

function tml_registration_handler() {
    // phpcs:disable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing -- mirrors wp-login.php's own registration-form processing (register_new_user()), which is a public unauthenticated form with no nonce.

    if ( is_multisite() ) {
        /** This filter is documented in wp-login.php */
        $signup_location = apply_filters( 'wp_signup_location', network_site_url( 'wp-signup.php' ) );

        // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- matches wp-login.php's own use of plain wp_redirect() here; $signup_location is always network_site_url()-derived, never raw user input.
        wp_redirect( $signup_location );
        exit;
    }

    if ( ! get_option( 'users_can_register' ) ) {
        if ( tml_is_ajax_request() ) {
            // phpcs:disable WordPress.WP.I18n.MissingArgDomain -- reusing WP core's translated wp-login.php string verbatim, not a TML-specific string.
            tml_add_error( 'registerdisabled', __( '<strong>Error:</strong> User registration is currently not allowed.' ) );
            // phpcs:enable WordPress.WP.I18n.MissingArgDomain
            tml_send_ajax_error(
                array(
                    'errors' => tml_get_form()->render_errors(),
                )
            );
        } else {
            // phpcs:ignore WordPress.Security.SafeRedirect.wp_redirect_wp_redirect -- matches wp-login.php's own use of plain wp_redirect() here; target is always site_url()-derived, never raw user input.
            wp_redirect( site_url( 'wp-login.php?registration=disabled' ) );
            exit;
        }
    }

    if ( tml_is_post_request() ) {
        $user_login = tml_get_request_value( 'user_login', 'post' );
        $user_email = tml_get_request_value( 'user_email', 'post' );
        $user_id    = register_new_user( $user_login, $user_email );
        if ( ! is_wp_error( $user_id ) ) {
            $redirect_to = ! empty( $_POST['redirect_to'] ) ? $_POST['redirect_to'] : site_url( 'wp-login.php?checkemail=registered' );

            /**
             * Filter the registration redirect.
             *
             * @since 7.0.10
             *
             * @param string $redirect_to The registration redirect.
             * @param WP_User $user       The user object.
             */
            $redirect_to = apply_filters( 'tml_registration_redirect', $redirect_to, get_userdata( $user_id ) );

            if ( tml_is_ajax_request() ) {
                wp_send_json_success(
                    array(
                        'redirect' => tml_validate_redirect( $redirect_to ),
                    )
                );
            } else {
                wp_safe_redirect( $redirect_to );
                exit;
            }
        } else {
            tml_set_errors( $user_id );
            if ( tml_is_ajax_request() ) {
                tml_send_ajax_error(
                    array(
                        'errors' => tml_get_form()->render_errors(),
                    )
                );
            }
        }
    }
    // phpcs:enable WordPress.Security.NonceVerification.Recommended, WordPress.Security.NonceVerification.Missing
}

View src/includes/actions.php, line 643 on GitHub