From cdc47554edf6106927d433f4810f146f98f89873 Mon Sep 17 00:00:00 2001
From: gsinghpal <gur_preet.singh@outlook.com>
Date: Sun, 17 May 2026 14:23:01 -0400
Subject: [PATCH] =?UTF-8?q?fix(portal):=20account=20summary=20sort=20dropd?=
 =?UTF-8?q?own=20=E2=80=94=20drop=20inline=20JS=20for=20CSP=20safety?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The inline 'onchange=\"window.location.href = this.value\"' attribute on
the sort <select> is the only inline-JS handler in the project's QWeb
templates. Under a strict Content-Security-Policy (script-src 'self')
the handler silently fails, leaving the sort dropdown dead. Replace
with a tiny vanilla-JS file (fp_portal_account_summary.js) that attaches
the listener via class selector .o_fp_sort_select inside the Account
Summary page.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../fusion_plating_portal/__manifest__.py     |  1 +
 .../src/js/fp_portal_account_summary.js       | 25 +++++++++++++++++++
 .../views/fp_portal_account_summary.xml       |  3 +--
 3 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 fusion_plating/fusion_plating_portal/static/src/js/fp_portal_account_summary.js

diff --git a/fusion_plating/fusion_plating_portal/__manifest__.py b/fusion_plating/fusion_plating_portal/__manifest__.py
index d82f41a3..95972936 100644
--- a/fusion_plating/fusion_plating_portal/__manifest__.py
+++ b/fusion_plating/fusion_plating_portal/__manifest__.py
@@ -83,6 +83,7 @@ Copyright (c) 2026 Nexa Systems Inc. All rights reserved.
             'fusion_plating_portal/static/src/scss/fusion_plating_portal.scss',
             'fusion_plating_portal/static/src/js/fp_rfq_form.js',
             'fusion_plating_portal/static/src/js/fp_portal_sidebar.js',  # NEW — Task 5
+            'fusion_plating_portal/static/src/js/fp_portal_account_summary.js',  # NEW — Task 10 fix
         ],
     },
     'demo': [
diff --git a/fusion_plating/fusion_plating_portal/static/src/js/fp_portal_account_summary.js b/fusion_plating/fusion_plating_portal/static/src/js/fp_portal_account_summary.js
new file mode 100644
index 00000000..bc726371
--- /dev/null
+++ b/fusion_plating/fusion_plating_portal/static/src/js/fp_portal_account_summary.js
@@ -0,0 +1,25 @@
+/**
+ * Fusion Plating — Portal Account Summary
+ * Wires the sort dropdown change event to navigate to the option's value
+ * (which is a fully-formed /my/account_summary URL). Replaces an inline
+ * `onchange` attribute on the <select> so the template stays CSP-clean.
+ */
+(function () {
+    "use strict";
+
+    function init() {
+        document.querySelectorAll(".o_fp_account_summary select.o_fp_sort_select").forEach(function (sel) {
+            sel.addEventListener("change", function () {
+                if (sel.value) {
+                    window.location.href = sel.value;
+                }
+            });
+        });
+    }
+
+    if (document.readyState === "loading") {
+        document.addEventListener("DOMContentLoaded", init);
+    } else {
+        init();
+    }
+})();
diff --git a/fusion_plating/fusion_plating_portal/views/fp_portal_account_summary.xml b/fusion_plating/fusion_plating_portal/views/fp_portal_account_summary.xml
index 179bd1c6..0e218e9b 100644
--- a/fusion_plating/fusion_plating_portal/views/fp_portal_account_summary.xml
+++ b/fusion_plating/fusion_plating_portal/views/fp_portal_account_summary.xml
@@ -56,8 +56,7 @@
                                    style="max-width: 260px"/>
                             <button type="submit" class="o_fp_btn_secondary o_fp_btn_sm">Search</button>
                         </form>
-                        <select onchange="window.location.href = this.value"
-                                class="form-select form-select-sm" style="max-width: 200px">
+                        <select class="form-select form-select-sm o_fp_sort_select" style="max-width: 200px">
                             <option t-att-value="'/my/account_summary?tab=' + active_tab + '&amp;filter_state=' + filter_state + '&amp;sort=date_desc&amp;search=' + search"
                                     t-att-selected="sort == 'date_desc'">Newest first</option>
                             <option t-att-value="'/my/account_summary?tab=' + active_tab + '&amp;filter_state=' + filter_state + '&amp;sort=date_asc&amp;search=' + search"