URLs are often double-escaped in smarty templates

[NateWr]

We often use {url|escape ...} in a Smarty template when the URL contains user input. However, the {url} function already escapes the final URL, so this is unnecessary.

All instances of {url|escape ...} should be changed to {url ...}.

[asmecher]

There is one case where the form {url|escape ...} is used in Javascript -- that should be changed to use json_encode instead. See lib/pkp/templates/controllers/grid/queries/form/queryForm.tpl:

$('#queryForm').pkpHandler(
 '$.pkp.controllers.form.CancelActionAjaxFormHandler',
   {ldelim}
     cancelUrl: {if $isNew}'{url|escape:javascript op="deleteQuery" queryId=$queryId csrfToken=$csrfToken params=$actionArgs escape=false}'{else}null{/if}
   {rdelim}
 );

The cancelUrl line should instead read:

 cancelUrl: {if $isNew}{url|json_encode op="deleteQuery" queryId=$queryId csrfToken=$csrfToken params=$actionArgs escape=false}{else}null{/if}

[NateWr]

PRs:
#8238
pkp/ojs#3537
pkp/omp#1197
pkp/ops#346

[NateWr]

Merged to main.