Pull Request resolves #48158.

Credit to @CyrusXxXxX for reporting and documenting the original issue.

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

CMSApplication::getUserStateFromRequest() now infers whether arrays are
expected from the caller's default and explicit filter.

• An array returned by a scalar filter no longer replaces scalar user state.
• Previously stored array state is repaired to the scalar default.
• Intentional array defaults and explicit array, raw, or none filters
  keep their existing array behavior.
• Unit coverage exercises rejected array input, repaired stored state, normal
  scalar input, and intentional recursively filtered arrays.

Testing Instructions

1. Run:
   libraries/vendor/bin/phpunit tests/Unit/Libraries/Cms/Application/CMSApplicationTest.php
2. Confirm all four tests and eight assertions pass.
3. Optionally request a core list view with an array parameter such as
   limit[]=5, then confirm scalar global.list.limit state is not replaced
   by an array.

Validation performed locally:

• Focused test file: 4 tests, 8 assertions
• Application unit-test directory: 5 tests, 10 assertions
• Full unit suite: 1,133 tests, 1,640 assertions
• Focused PHPStan: no errors
• Joomla PHPCS on both changed files: pass
• git diff --check: pass

Actual result BEFORE applying this Pull Request

An array request filtered as uint remains an array because Joomla Framework's
input filter recursively filters array values. The application persists that
array into scalar session state such as global.list.limit.

Expected result AFTER applying this Pull Request

Scalar user state remains scalar. Array input is ignored for scalar state, and
already poisoned state is repaired to the caller's scalar default. Callers that
intentionally expect arrays retain their existing behavior.

Link to documentations

Please select:

• No documentation changes for guide.joomla.org needed

• No documentation changes for manual.joomla.org needed