fix: add escJs for JS string escaping in onclick attributes, apply to users/templates/notifications

public/js/pages/templates.js

@@ -15,7 +15,7 @@ const TemplatesPage = {
         <div class="card"><div class="card-h"><span>${U.esc(t.name)}</span><code class="ts tm">${t.code}</code></div><div class="card-b">
           <div class="detail-row"><span class="lbl">主题</span><span class="val">${U.esc(t.subject)}</span></div>
           ${t.description ? `<div class="detail-row"><span class="lbl">说明</span><span class="val tm">${U.esc(t.description)}</span></div>` : ''}
-          <div class="mt-2"><button class="btn btn-p btn-sm" onclick="TemplatesPage.edit('${t.code}', '${U.esc(t.name)}')"><i class="fas fa-edit"></i> 编辑模板</button></div>
+          <div class="mt-2"><button class="btn btn-p btn-sm" onclick="TemplatesPage.edit('${U.escJs(t.code)}', '${U.escJs(t.name)}')"><i class="fas fa-edit"></i> 编辑模板</button></div>
         </div></div>
       `).join('');
     } catch (e) { ct.innerHTML = `<div class="alert alert-e">${e.message}</div>`; }