Even though allowed values is given an array, that does not mean that we should parse the input as multivalue. This prevents allowing string values with | in them. This forces to check the param value manually elsewhere in the code.
Version: 1.20.x
Severity: normal
As of now, I see this code in ApiBase.php:
<code>
if ( isset( $value ) && ( $multi || is_array( $type ) ) ) {
$value = $this->parseMultiValue( $encParamName, $value, $multi, is_array( $type ) ? $type : null );
}
</code>
May be we need to change that OR to AND condition, so that the value can contain | , even if the allowed values are array when PARAM_ISMULTI is false
There is another bug related to ISMULTI in APIBase.php
<code>
if ( isset( $paramSettings[self::PARAM_ISMULTI] ) ) {
$prompt = 'Values (separate with \'|\'): ';
} else {
$prompt = 'One value: ';
}
</code>
Looks like the condition require additional condition - && $paramSettings[self::PARAM_ISMULTI]