decode q param, when entering it in search box

[pvgenuchten]

Overview

this decodes the q parameter before entering it in the search box, it also replaces + by ' ', because it is not picked up by decode

Related Issue / Discussion

#1036

Additional Information

i'm using js to decode, because the urllib (with quote) library is currently not available in the jinja template, would you prefer to use python to decode?

To some, this may look like a vulnerability option to inject js via querystring, it is not the case, because the q parameter is carefully checked. try things like

https://demo.pycsw.org/cite/collections/metadata:main/items?q=%27%3Cscript%3Ealert(55)%3C%2Fscript%3E

Contributions and Licensing

(as per https://github.com/geopython/pycsw/blob/master/CONTRIBUTING.rst#contributions-and-licensing)

• I'd like to contribute [feature X|bugfix Y|docs|something else] to pycsw. I confirm that my contributions to pycsw will be compatible with the pycsw license guidelines at the time of contribution.
• I have already previously agreed to the pycsw Contributions and Licensing Guidelines