fix: add escJs for JS string escaping in onclick attributes, apply to users/templates/notifications

public/js/pages/notifications.js

@@ -17,7 +17,7 @@ const NotificationsPage = {
           ${c.webhook_url?`<div class="detail-row"><span class="lbl">地址</span><span class="val ts" style="word-break:break-all">${U.esc(c.webhook_url)}</span></div>`:''}
           <div class="detail-row"><span class="lbl">事件</span><span class="val">${EventsLabel(c.events)}</span></div>
           <div class="mt-2 flex g2">
-            <button class="btn btn-o btn-sm" onclick="NotificationsPage.showEdit(${c.id},'${U.esc(c.name)}','${c.type}','${U.esc(c.webhook_url)}','${c.events}',${c.active})"><i class="fas fa-edit"></i> 编辑</button>
+            <button class="btn btn-o btn-sm" onclick="NotificationsPage.showEdit(${c.id},'${U.escJs(c.name)}','${c.type}','${U.escJs(c.webhook_url)}','${c.events}',${c.active})"><i class="fas fa-edit"></i> 编辑</button>
             <button class="btn btn-i btn-sm" onclick="NotificationsPage.test(${c.id})"><i class="fas fa-paper-plane"></i> 测试</button>
             <button class="btn btn-d btn-sm" onclick="NotificationsPage.del(${c.id})"><i class="fas fa-trash"></i> 删除</button>
           </div>

public/js/pages/templates.js

@@ -15,7 +15,7 @@ const TemplatesPage = {
         <div class="card"><div class="card-h"><span>${U.esc(t.name)}</span><code class="ts tm">${t.code}</code></div><div class="card-b">
           <div class="detail-row"><span class="lbl">主题</span><span class="val">${U.esc(t.subject)}</span></div>
           ${t.description ? `<div class="detail-row"><span class="lbl">说明</span><span class="val tm">${U.esc(t.description)}</span></div>` : ''}
-          <div class="mt-2"><button class="btn btn-p btn-sm" onclick="TemplatesPage.edit('${t.code}', '${U.esc(t.name)}')"><i class="fas fa-edit"></i> 编辑模板</button></div>
+          <div class="mt-2"><button class="btn btn-p btn-sm" onclick="TemplatesPage.edit('${U.escJs(t.code)}', '${U.escJs(t.name)}')"><i class="fas fa-edit"></i> 编辑模板</button></div>
         </div></div>
       `).join('');
     } catch (e) { ct.innerHTML = `<div class="alert alert-e">${e.message}</div>`; }

public/js/pages/users.js

@@ -21,7 +21,7 @@ const UsersPage = {
             <td>${U.badge(u.role,'role')}</td>
             <td>${u.active ? '<span class="badge bg-resolved">启用</span>' : '<span class="badge bg-rejected">禁用</span>'}</td>
             <td class="ts">${U.date(u.created_at)}</td>
-            <td><button class="btn btn-o btn-sm" onclick="UsersPage.editUser(${u.id}, '${U.esc(u.username)}', '${U.esc(u.email)}', '${U.esc(u.game_name)}', '${U.esc(u.game_uid)}', '${u.role}', ${u.active})"><i class="fas fa-edit"></i></button></td>
+             <td><button class="btn btn-o btn-sm" onclick="UsersPage.editUser(${u.id}, '${U.escJs(u.username)}', '${U.escJs(u.email)}', '${U.escJs(u.game_name)}', '${U.escJs(u.game_uid)}', '${u.role}', ${u.active})"><i class="fas fa-edit"></i></button></td>
           </tr>`).join('')}</tbody></table></div>
       `;
     } catch (e) { ct.innerHTML = `<div class="alert alert-e">${e.message}</div>`; }

public/js/utils.js

@@ -25,6 +25,11 @@ const U = {
     return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;').replace(/'/g,'&#39;');
   },
 
+  escJs(s) {
+    if (!s) return '';
+    return String(s).replace(/\\/g,'\\\\').replace(/'/g,"\\'").replace(/\n/g,'\\n');
+  },
+
   showAlert(containerId, type, msg) {
     const ct = document.getElementById(containerId || 'page-content');
     const el = document.createElement('div');