Pull Request resolves #45770 .

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

In the front end when you display a category list the sort headings are an inline onclick attribute. This is blocked when a Content Security Policy (CSP) is configured to disallow inline JavaScript.

This was resolved in the past for the admin but not for the front end. The sort link now uses data attributes to store the ordering information and the existing list-view JavaScript asset handles the click event and calls Joomla.tableOrdering().

The existing sort direction icons and sorting behaviour are unchanged.

Testing Instructions

This contains js changes so either use a pre-built package or apply the pr and rebuild the js with npm i

Create a menu item of type category list (or use the sample data)

check that you can sort the data in the table by clicking on the column headers

Actual result BEFORE applying this Pull Request

If you inspect the generated code for the column headers you will see

<a href="#" onclick="Joomla.tableOrdering('a.title','asc','', document.getElementById('adminForm'));return false;" class="hasTooltip" data-bs-placement="top" data-bs-original-title="Select to sort by this column">Title<span class="icon-arrow-down-3"></span></a>

Expected result AFTER applying this Pull Request

Visually there is no change and you can still sort the column headers but there is no inline js - if you inspect the column headers you will see

<a href="#" class="hasTooltip js-grid-item-sort" data-order="a.title" data-direction="asc" data-task="" data-form="adminForm" data-bs-placement="top" data-bs-original-title="Select to sort by this column">Title</a>

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed