Pull Request for Issue #45770 (part of the series described in #48738).

• I read the Generative AI policy and my contribution is either not created with the help of AI or is compatible with the policy and GNU/GPL 2 or later.

Summary of Changes

With the Nonce option of the System - HTTP Headers plugin enabled, browsers ignore 'unsafe-inline' and block inline event handlers. This PR removes the ones left in toolbar and workflow buttons on core administrator screens. It follows #48737 (list views) and the pattern of #45910 and #48523. Each change uses a hook that core already has where possible:

• Articles, workflow stage button and transition select (layouts/joomla/button/transition-button.php): #39730 added the js-grid-button-transition-action and js-grid-item-transition-action handlers to list-view, but the layout never used them. It now does, with data-item-id and data-item-task, and loads list-view itself like action-button.php.
• Articles, Actions > Run Transition items: these are now standard toolbar buttons with the articles.runTransition task and listCheck, like the Publish items next to them. Each one has a data-transition-id. admin-items-workflow-buttons.js copies that id into transition_id before joomla-toolbar-button submits the form, using a capture-phase listener.
• Modules, New: a link button to the module type list, as Scheduled Tasks already does. Modules, Select a Module Type, Cancel: a plain link.
• Multilingual Associations, side by side: Save Reference and Save Target are standard toolbar buttons with the reference and target tasks, which the existing Joomla.submitbutton override of sidebyside.js handles. The Clear button is handled in sidebyside.js.
• Smart Search, debug indexer (Index button): a basic button that debug.js binds to Joomla.debugIndexing().
• Users, Multi-factor Authentication method edit, toolbar Save: a basic button that a small new script, com_users.two-factor-edit, binds so that it clicks the form's own save button, as two-factor-focus.js already does on the captive page. The WebAuthn handler on that button still runs.

For b/c:

• layouts/joomla/toolbar/basic.php and standard.php still render onclick for extensions that pass one. Only the core callers changed.
• A template override of transition-button.php or cancelselect.php keeps working as before, still with its inline handler.
• With nothing selected, the Run Transition items are now disabled instead of showing a message. They are hidden until rows are selected anyway.
• Modules New is now a link, so middle-click opens it in a new tab, as with other core link buttons.

The next PRs in #48738 cover the administrator modals and the component views.

Testing Instructions

This PR changes JavaScript (com_workflow, com_associations, com_finder, com_users), so use the prebuilt package or run npm ci after applying it.

1. Plugins: System - HTTP Headers, tab Content-Security-Policy (CSP). Set Content Security Policy (CSP) to Enabled, Client to Both, Report-Only to No, Nonce to Yes and strict-dynamic to Yes. Under Add Directive, add Policy Directive script-src, Value 'self', Client Both. Save.
2. Articles: Options, Integration, Enable Workflow: Yes. In Content: Articles, click the icon in the Stage column of an article and choose Unpublish.
3. Select another article, open Actions and click Archive under Run Transition.
4. Content: Site Modules. Click New, then Cancel.
5. Global Configuration: Debug System Yes. In Smart Search: Index, open the Index dropdown and click Index Debugging. Choose the Content plugin, enter an article ID and click Index.
6. Users: Manage, edit your user, tab Multi-factor Authentication, Add a new Authenticator Code. Enter any 6 digits and click Save & Close in the toolbar.
7. With System - Language Filter enabled (Item Associations Yes) and a second content language, open Multilingual Associations, pick a language-specific article and edit its association. Click Save Reference. Select a target and click Clear.
8. Repeat steps 2 to 7 with the CSP disabled.

Actual result BEFORE applying this Pull Request

With the CSP enabled, none of these buttons does anything. The stage button does not open the transition select, Run Transition does not run, New and Cancel stay on the page, Index sends no request, Save & Close does not submit, and Save Reference and Clear do nothing. The browser console reports a Content Security Policy violation for each inline event handler.

Expected result AFTER applying this Pull Request

With the CSP enabled:
2. The transition select opens, and choosing Unpublish runs the transition ("New state saved.").
3. The selected article is archived.
4. New opens Select a Module Type. Cancel goes back to the modules list.
5. The indexer output shows the result for that item.
6. The form is submitted. With a wrong code, the page reloads with "You did not enter a valid verification code".
7. Save Reference saves the reference item, and Clear removes the association.

None of these report a Content Security Policy violation. The header "Check All Items" checkbox still reports one until #48737 is merged.

With the CSP disabled, everything works as before.

Link to documentations

Please select:

• Documentation link for guide.joomla.org:

• No documentation changes for guide.joomla.org needed

• Pull Request link for manual.joomla.org:

• No documentation changes for manual.joomla.org needed