Pull Request for Issue #45770 (the limit box; the sort headings are #48523).

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

With the Nonce option of the System - HTTP Headers plugin enabled, browsers ignore 'unsafe-inline' and block inline event handlers. Some list controls still rely on them:

• the "Check All Items" checkbox in the header of every administrator list (Grid::checkall)
• the administrator pagination links (layouts/joomla/pagination/link.php)
• the "Display #" limit box of the frontend category, tag, contact and newsfeed lists and of the archive (Pagination::getLimitBox): this is the second half of #45770

#45910 already did this for the row checkboxes (Grid::id), and #48523 does it for the frontend sort headings (Grid::sort). Following the same approach, these controls now use classes and data attributes that the list-view script handles. Each helper loads that script itself:

• Grid::checkall: uses the existing js-grid-item-check-all handler. A custom $action is still rendered as an inline onclick, for b/c.
• Pagination::getLimitBox and Grid::state: a new js-grid-submit-on-change handler submits the select's form with Joomla.submitform(). The administrator and site branches of getLimitBox rendered the same select with a different onchange; they are now one.
• Administrator pagination links: data-limitstart and data-limitstart-field attributes, and a new js-grid-pagination-link handler that sets limitstart and submits adminForm, as the inline code did. Site pagination links are plain links and do not change.

New unit tests cover the markup of these helpers: tests/Unit/Libraries/Cms/Html/HtmlGridTest.php and tests/Unit/Libraries/Cms/Pagination/PaginationTest.php.

This PR does not touch Grid::sort and merges cleanly with #48523. It is the first of a few PRs, split by area, so that the core screens work with a nonce-based policy. The next ones cover the toolbar and shared layouts, the administrator modals and the component views.

For b/c:

• On the frontend, the limit box now submits through Joomla.submitform(), which fires the form's submit event; form.submit() did not.
• If these helpers' markup is loaded by an AJAX request, the page needs the list-view script, as it already does for Grid::id since #45910.
• getLimitBox() loads list-view, and with it core, whenever it is called. That includes getListFooter(), which hides the box by default. On administrator lists both scripts are already loaded by Grid::id.

Testing Instructions

This PR changes JavaScript (media_source/system/js/list-view.es6.js), so use the prebuilt package or run npm ci after applying it.

1. Plugins: System - HTTP Headers, tab Content-Security-Policy (CSP). Set Content Security Policy (CSP) to Enabled, Client to Both, Report-Only to No, Nonce to Yes and strict-dynamic to Yes. Under Add Directive, add Policy Directive script-src, Value 'self', Client Both. Save.
2. Administrator, Content: Articles (with some articles). Click the checkbox in the table header, then click it again.
3. Administrator, System: Plugins. Click page 2 in the pagination below the list.
4. Frontend: open a menu item of type Articles, Category List, for a category with more than 5 articles, with Display Select set to Show. Change "Display #".
5. Repeat steps 2 to 4 with the CSP disabled.

Actual result BEFORE applying this Pull Request

With the CSP enabled:
2. No row is checked.
3. The list stays on page 1.
4. The list is not reloaded.

For each of these, the browser console reports a Content Security Policy violation for an inline event handler.

Expected result AFTER applying this Pull Request

With the CSP enabled:
2. All rows are checked and the toolbar actions are enabled. The second click unchecks them.
3. Page 2 is shown.
4. The list reloads with the selected number of articles.

These controls report no Content Security Policy violation. The column sort links still report one until #48523 is merged.

With the CSP disabled, everything works as before.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed