fix: add escJs for JS string escaping in onclick attributes, apply to users/templates/notifications

public/js/pages/users.js

@@ -21,7 +21,7 @@ const UsersPage = {
             <td>${U.badge(u.role,'role')}</td>
             <td>${u.active ? '<span class="badge bg-resolved">启用</span>' : '<span class="badge bg-rejected">禁用</span>'}</td>
             <td class="ts">${U.date(u.created_at)}</td>
-            <td><button class="btn btn-o btn-sm" onclick="UsersPage.editUser(${u.id}, '${U.esc(u.username)}', '${U.esc(u.email)}', '${U.esc(u.game_name)}', '${U.esc(u.game_uid)}', '${u.role}', ${u.active})"><i class="fas fa-edit"></i></button></td>
+             <td><button class="btn btn-o btn-sm" onclick="UsersPage.editUser(${u.id}, '${U.escJs(u.username)}', '${U.escJs(u.email)}', '${U.escJs(u.game_name)}', '${U.escJs(u.game_uid)}', '${u.role}', ${u.active})"><i class="fas fa-edit"></i></button></td>
           </tr>`).join('')}</tbody></table></div>
       `;
     } catch (e) { ct.innerHTML = `<div class="alert alert-e">${e.message}</div>`; }