findUsersByUsernameNative(String username);
+}
\ No newline at end of file
diff --git a/src/main/java/top/whgojp/modules/sqli/service/HsqliService.java b/src/main/java/top/whgojp/modules/sqli/service/HsqliService.java
deleted file mode 100644
index 61dae36..0000000
--- a/src/main/java/top/whgojp/modules/sqli/service/HsqliService.java
+++ /dev/null
@@ -1,11 +0,0 @@
-//package top.whgojp.modules.sqli.service;
-//
-///**
-// * @description <功能描述>
-// * @author: whgojp
-// * @email: whgojp@foxmail.com
-// * @Date: 2024/8/5 18:11
-// */
-//public interface HsqliService {
-//
-//}
diff --git a/src/main/java/top/whgojp/modules/ssrf/controller/SsrfController.java b/src/main/java/top/whgojp/modules/ssrf/controller/SsrfController.java
index aa39417..6a864f0 100644
--- a/src/main/java/top/whgojp/modules/ssrf/controller/SsrfController.java
+++ b/src/main/java/top/whgojp/modules/ssrf/controller/SsrfController.java
@@ -10,10 +10,14 @@
import org.springframework.web.bind.annotation.*;
import top.whgojp.common.utils.CheckUserInput;
+import javax.servlet.http.HttpServletResponse;
import java.io.BufferedReader;
+import java.io.IOException;
import java.io.InputStreamReader;
+import java.net.HttpURLConnection;
import java.net.URL;
import java.net.URLConnection;
+import java.nio.charset.StandardCharsets;
/**
* @description SSRF-服务端请求伪造
@@ -32,7 +36,23 @@ public String fileUpload() {
return "vul/ssrf/ssrf";
}
- @ApiOperation(value = "漏洞环境：服务端请求伪造", notes = "原生漏洞环境，未做任何限制，可调用URLConnection发起任意请求，探测内网服务、读取文件")
+ @ApiOperation(value = "模拟内网元数据服务", notes = "用于SSRF场景演示，模拟攻击者通过服务端访问内网或云元数据接口")
+ @GetMapping("/internal/metadata")
+ @ResponseBody
+ public String internalMetadata() {
+ return "instance-id: i-javaseclab-ssrf\n"
+ + "role: internal-admin\n"
+ + "token: javaseclab-metadata-token\n"
+ + "source: 127.0.0.1";
+ }
+
+ @ApiOperation(value = "模拟跳转链路", notes = "用于演示SSRF修复时必须禁用自动跳转，或对每一跳重新校验")
+ @GetMapping("/redirect")
+ public void redirect(@RequestParam String target, HttpServletResponse response) throws IOException {
+ response.sendRedirect(target);
+ }
+
+ @ApiOperation(value = "漏洞场景：服务端请求伪造", notes = "原生漏洞场景，未做任何限制，可调用URLConnection发起任意请求，探测内网服务、读取文件")
@GetMapping("/vul")
@ResponseBody
@ApiImplicitParam(name = "url", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
@@ -70,8 +90,11 @@ public String safe(@ApiParam(name = "url", value = "请求参数", required = tr
} else {
try {
URL u = new URL(url);
- URLConnection conn = u.openConnection(); // 这里以URLConnection作为演示
- BufferedReader reader = new BufferedReader(new InputStreamReader(conn.getInputStream()));
+ HttpURLConnection conn = (HttpURLConnection) u.openConnection();
+ conn.setInstanceFollowRedirects(false);
+ conn.setConnectTimeout(3000);
+ conn.setReadTimeout(3000);
+ BufferedReader reader = new BufferedReader(new InputStreamReader(conn.getInputStream(), StandardCharsets.UTF_8));
String content;
StringBuilder html = new StringBuilder();
html.append("");
diff --git a/src/main/java/top/whgojp/modules/ssti/controller/SSTIController.java b/src/main/java/top/whgojp/modules/ssti/controller/SSTIController.java
index 7fa1c5c..702b8b5 100644
--- a/src/main/java/top/whgojp/modules/ssti/controller/SSTIController.java
+++ b/src/main/java/top/whgojp/modules/ssti/controller/SSTIController.java
@@ -5,18 +5,12 @@
import io.swagger.annotations.ApiOperation;
import io.swagger.annotations.ApiParam;
import lombok.extern.slf4j.Slf4j;
-import org.springframework.expression.EvaluationContext;
-import org.springframework.expression.Expression;
-import org.springframework.expression.ExpressionParser;
-import org.springframework.expression.spel.standard.SpelExpressionParser;
-import org.springframework.expression.spel.support.SimpleEvaluationContext;
-import org.springframework.expression.spel.support.StandardEvaluationContext;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.*;
-import top.whgojp.common.utils.R;
import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
@@ -38,7 +32,7 @@ public String ssti() {
return "vul/ssti/ssti";
}
- @ApiOperation(value = "漏洞环境：Thymeleaf模板注入", notes = "如果参数未经过滤，攻击者可以注入恶意模板参数，执行任意代码。")
+ @ApiOperation(value = "漏洞场景：Thymeleaf模板注入", notes = "如果参数未经过滤，攻击者可以注入恶意模板参数，执行任意代码。")
@ApiImplicitParam(name = "para", value = "用户输入参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
@GetMapping("/vul1")
public String vul1(@ApiParam(name = "para", value = "用户输入参数", required = true) @RequestParam String para, Model model) {
@@ -46,11 +40,12 @@ public String vul1(@ApiParam(name = "para", value = "用户输入参数", requir
// return "vul/ssti/vul"; // 将参数 para 传递到模板 "vul/ssti/template"
// 用户输入直接拼接到模板路径，可能导致SSTI（服务器端模板注入）漏洞
- return "/vul/ssti/" + para;
+ return "vul/ssti/" + para;
}
@GetMapping("/vul2/{path}")
- public void vul2(@PathVariable String path) {
- log.info("SSTI注入："+path);
+ public String vul2(@PathVariable String path) {
+ log.info("SSTI注入：" + path);
+ return "vul/ssti/" + path;
}
@GetMapping("/vul3")
public String vul3(@ApiParam(name = "para", value = "用户输入参数", required = true) @RequestParam String para, Model model) {
@@ -62,16 +57,18 @@ public String vul3(@ApiParam(name = "para", value = "用户输入参数", requir
public String safe1(@ApiParam(name = "para", value = "用户输入参数", required = true) @RequestParam String para, Model model) {
List white_list = new ArrayList<>(Arrays.asList("vul", "ssti"));
if (white_list.contains(para)){
- return "vul/ssti" + para;
+ return "vul/ssti/" + para;
} else{
return "common/401";
}
}
@GetMapping("/safe2/{path}")
- public void safe2(@PathVariable String path, HttpServletResponse response) {
- log.info("SSTI注入："+path);
+ public void safe2(@PathVariable String path, HttpServletResponse response) throws IOException {
+ log.info("SSTI注入：" + path);
+ response.setContentType("text/plain;charset=UTF-8");
+ response.getWriter().write("已跳过视图解析，输入路径：" + path);
}
-}
\ No newline at end of file
+}
diff --git a/src/main/java/top/whgojp/modules/xss/config/XssWebSocketConfig.java b/src/main/java/top/whgojp/modules/xss/config/XssWebSocketConfig.java
new file mode 100644
index 0000000..e1e67f6
--- /dev/null
+++ b/src/main/java/top/whgojp/modules/xss/config/XssWebSocketConfig.java
@@ -0,0 +1,18 @@
+package top.whgojp.modules.xss.config;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.lang.NonNull;
+import org.springframework.web.socket.config.annotation.EnableWebSocket;
+import org.springframework.web.socket.config.annotation.WebSocketConfigurer;
+import org.springframework.web.socket.config.annotation.WebSocketHandlerRegistry;
+
+@Configuration
+@EnableWebSocket
+public class XssWebSocketConfig implements WebSocketConfigurer {
+
+ @Override
+ public void registerWebSocketHandlers(@NonNull WebSocketHandlerRegistry registry) {
+ registry.addHandler(new XssWebSocketHandler(), "/xss/websocket")
+ .setAllowedOrigins("*"); // 故意允许所有源，用于演示XSS风险
+ }
+}
diff --git a/src/main/java/top/whgojp/modules/xss/config/XssWebSocketHandler.java b/src/main/java/top/whgojp/modules/xss/config/XssWebSocketHandler.java
new file mode 100644
index 0000000..18488ef
--- /dev/null
+++ b/src/main/java/top/whgojp/modules/xss/config/XssWebSocketHandler.java
@@ -0,0 +1,53 @@
+package top.whgojp.modules.xss.config;
+
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.lang.NonNull;
+import org.springframework.web.socket.CloseStatus;
+import org.springframework.web.socket.TextMessage;
+import org.springframework.web.socket.WebSocketSession;
+import org.springframework.web.socket.handler.TextWebSocketHandler;
+
+import java.io.IOException;
+import java.util.concurrent.CopyOnWriteArraySet;
+
+@Slf4j
+public class XssWebSocketHandler extends TextWebSocketHandler {
+
+ private static final CopyOnWriteArraySet sessions = new CopyOnWriteArraySet<>();
+
+ @Override
+ public void afterConnectionEstablished(@NonNull WebSocketSession session) {
+ sessions.add(session);
+ log.info("WebSocket connection established - Current connections: {}", sessions.size());
+ try {
+ session.sendMessage(new TextMessage("Connected successfully"));
+ } catch (IOException e) {
+ log.error("Failed to send welcome message: {}", e.getMessage());
+ }
+ }
+
+ @Override
+ protected void handleTextMessage(@NonNull WebSocketSession session, @NonNull TextMessage message) {
+ log.info("Received message: {}", message.getPayload());
+ // 故意不过滤消息内容，用于演示XSS风险
+ broadcast(message);
+ }
+
+ @Override
+ public void afterConnectionClosed(@NonNull WebSocketSession session, @NonNull CloseStatus status) {
+ sessions.remove(session);
+ log.info("WebSocket connection closed - Current connections: {}", sessions.size());
+ }
+
+ private void broadcast(TextMessage message) {
+ for (WebSocketSession session : sessions) {
+ try {
+ if (session.isOpen()) {
+ session.sendMessage(message);
+ }
+ } catch (IOException e) {
+ log.error("Failed to send message to session {}: {}", session.getId(), e.getMessage());
+ }
+ }
+ }
+}
diff --git a/src/main/java/top/whgojp/modules/xss/controller/ActionEnterRewrite.java b/src/main/java/top/whgojp/modules/xss/controller/ActionEnterRewrite.java
index cae747e..6c197b6 100644
--- a/src/main/java/top/whgojp/modules/xss/controller/ActionEnterRewrite.java
+++ b/src/main/java/top/whgojp/modules/xss/controller/ActionEnterRewrite.java
@@ -14,10 +14,6 @@
import javax.servlet.http.HttpServletRequest;
import java.util.Map;
-/**
- * 描述:
- * 创建人: 慌途L
- */
@Slf4j
public class ActionEnterRewrite {
private HttpServletRequest request;
diff --git a/src/main/java/top/whgojp/modules/xss/controller/DomController.java b/src/main/java/top/whgojp/modules/xss/controller/DomController.java
index d745015..e5034c8 100644
--- a/src/main/java/top/whgojp/modules/xss/controller/DomController.java
+++ b/src/main/java/top/whgojp/modules/xss/controller/DomController.java
@@ -14,7 +14,7 @@
* @Date: 2024/5/23 17:25
*/
@Slf4j
-@Api(value = "ReflectController", tags = "跨站脚本-Dom型XSS")
+@Api(value = "DomController", tags = "跨站脚本-DOM型XSS")
@Controller
@CrossOrigin(origins = "*")
@RequestMapping("/xss/dom")
diff --git a/src/main/java/top/whgojp/modules/xss/controller/FileUtils.java b/src/main/java/top/whgojp/modules/xss/controller/FileUtils.java
index d5ab2ec..9a63996 100644
--- a/src/main/java/top/whgojp/modules/xss/controller/FileUtils.java
+++ b/src/main/java/top/whgojp/modules/xss/controller/FileUtils.java
@@ -11,48 +11,47 @@
import java.io.File;
import java.io.IOException;
-import java.util.Random;
+import java.util.UUID;
+
-/**
- * 功能 : 上传文件工具类
- * 创建人 : 慌途L
- */
@Slf4j
public class FileUtils {
public static String upLoadFile(MultipartFile file, String path) {
-
- if(file.isEmpty()){
+ if (file == null || file.isEmpty()) {
log.info("文件为空！");
return null;
}
+
String fileName = file.getOriginalFilename();
- int size = (int) file.getSize();
- log.info(fileName + "-->" + size);
-
- // 取得文件的后缀名。
- String ext = fileName.substring(fileName.lastIndexOf(".") + 1).toUpperCase();
-
- String newFileName =
- System.currentTimeMillis() / 1000 + new Random().nextInt(100000)+"." + ext;
+ log.info("上传文件: {} - 大小: {}", fileName, file.getSize());
- //String path = "F:/test" ;
- File dest = new File(path + "/" + newFileName);
- if(!dest.getParentFile().exists()){ //判断文件父目录是否存在
- dest.getParentFile().mkdir();
+ String ext = getFileExtension(fileName);
+ String newFileName = generateUniqueFileName(ext);
+
+ return saveFile(file, path, newFileName);
+ }
+
+ private static String getFileExtension(String fileName) {
+ return fileName.substring(fileName.lastIndexOf(".") + 1).toUpperCase();
+ }
+
+ private static String generateUniqueFileName(String ext) {
+ return UUID.randomUUID().toString() + "." + ext;
+ }
+
+ private static String saveFile(MultipartFile file, String path, String newFileName) {
+ File dest = new File(path, newFileName);
+ if (!dest.getParentFile().exists()) {
+ dest.getParentFile().mkdirs();
}
+
try {
- file.transferTo(dest); //保存文件
+ file.transferTo(dest);
return newFileName;
- } catch (IllegalStateException e) {
- // TODO Auto-generated catch block
- e.printStackTrace();
- return null;
} catch (IOException e) {
- // TODO Auto-generated catch block
- e.printStackTrace();
+ log.error("文件保存失败", e);
return null;
}
}
}
-
diff --git a/src/main/java/top/whgojp/modules/xss/controller/JsonpController.java b/src/main/java/top/whgojp/modules/xss/controller/JsonpController.java
new file mode 100644
index 0000000..3c4a30f
--- /dev/null
+++ b/src/main/java/top/whgojp/modules/xss/controller/JsonpController.java
@@ -0,0 +1,17 @@
+package top.whgojp.modules.xss.controller;
+
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/xss")
+public class JsonpController {
+
+ @GetMapping("/jsonp")
+ public String handleJsonp(@RequestParam String callback) {
+ // 故意不验证callback参数，直接拼接返回
+ return callback + "(" + "{\"message\": \"Hello from JSONP\"}" + ");";
+ }
+}
diff --git a/src/main/java/top/whgojp/modules/xss/controller/OtherController.java b/src/main/java/top/whgojp/modules/xss/controller/OtherController.java
index 774050e..e79a44b 100644
--- a/src/main/java/top/whgojp/modules/xss/controller/OtherController.java
+++ b/src/main/java/top/whgojp/modules/xss/controller/OtherController.java
@@ -84,7 +84,7 @@ public R hackCookie(@RequestParam String cookie, HttpServletRequest request) {
private UploadUtil uploadUtil;
// 文件上传接口
- @ApiOperation(value = "漏洞环境：文件上传导致存储XSS", notes = "原生漏洞环境,未加任何过滤，Controller接口返回Json类型结果")
+ @ApiOperation(value = "漏洞场景：文件上传导致存储XSS", notes = "上传可被浏览器或预览服务解析的文件，后续访问文件时可能触发XSS")
@RequestMapping("/vul1Upload")
@ResponseBody
@SneakyThrows
@@ -110,6 +110,7 @@ public R vul1Upload(@RequestParam("file") MultipartFile file,
} catch (Exception e) {
return R.error("上传错误，请检查后重新上传：" + e.getMessage());
}
+ // XML解析成功后继续落盘，便于演示“解析 + 可访问文件”组合场景。
case "html":
case "svg":
case "pdf":
@@ -122,14 +123,14 @@ public R vul1Upload(@RequestParam("file") MultipartFile file,
return R.error(res);
}
}
- @ApiOperation(value = "漏洞环境：模版引擎解析导致存储XSS", notes = "")
+ @ApiOperation(value = "漏洞场景：模板引擎不安全渲染导致XSS", notes = "th:utext会把内容作为HTML渲染，th:text会进行转义")
@GetMapping("/vul2OtherTemplate")
- public String vul2OtherTemplate(@RequestParam("content") String content,
+ public String vul2OtherTemplate(@RequestParam("payload") String payload,
@RequestParam("type") String type, Model model) {
if ("html".equals(type)) {
- model.addAttribute("html", content);
+ model.addAttribute("html", payload);
} else if ("text".equals(type)) {
- model.addAttribute("text", content);
+ model.addAttribute("text", payload);
}
return "vul/xss/other";
}
diff --git a/src/main/java/top/whgojp/modules/xss/controller/PostMessageController.java b/src/main/java/top/whgojp/modules/xss/controller/PostMessageController.java
new file mode 100644
index 0000000..e5d8e82
--- /dev/null
+++ b/src/main/java/top/whgojp/modules/xss/controller/PostMessageController.java
@@ -0,0 +1,20 @@
+package top.whgojp.modules.xss.controller;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+@Controller
+@RequestMapping("/xss/postmessage")
+public class PostMessageController {
+
+ @GetMapping("/sender")
+ public String sender() {
+ return "vul/xss/postmessage/sender";
+ }
+
+ @GetMapping("/receiver")
+ public String receiver() {
+ return "vul/xss/postmessage/receiver";
+ }
+}
diff --git a/src/main/java/top/whgojp/modules/xss/controller/ReflectController.java b/src/main/java/top/whgojp/modules/xss/controller/ReflectController.java
index 753e357..6266dd4 100644
--- a/src/main/java/top/whgojp/modules/xss/controller/ReflectController.java
+++ b/src/main/java/top/whgojp/modules/xss/controller/ReflectController.java
@@ -12,11 +12,11 @@
import org.thymeleaf.util.StringUtils;
import top.whgojp.common.utils.CheckUserInput;
import top.whgojp.common.utils.R;
+import top.whgojp.modules.xss.controller.base.XssBaseController;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpUtils;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -27,65 +27,57 @@
* @Date: 2024/5/20 16:55
*/
@Slf4j
-@Api(value = "ReflectController", tags = "跨站脚本-反射型XSS")
+@Api(value = "ReflectController", tags = "跨站脚本 - 反射型XSS")
@Controller
@CrossOrigin(origins = "*")
@RequestMapping("/xss/reflect")
-public class ReflectController {
+public class ReflectController extends XssBaseController {
+
@Autowired
private CheckUserInput checkUserInput;
- @RequestMapping("")
- public String xssReflect() {
- return "vul/xss/reflect";
- }
- @RequestMapping("/vul")
- public String xssReflectVul() {
- return "vul/xss/reflect-vul";
- }
- @RequestMapping("/safe")
- public String xssReflectSafe() {
- return "vul/xss/reflect-safe";
- }
+ @RequestMapping("/{view}")
+ public String reflect(@PathVariable String view) {
+ return isValidView(view) ? "vul/xss/reflect/" + view : "error/404";
+ }
- @ApiOperation(value = "漏洞环境：GET型与POST型", notes = "原生漏洞环境,未加任何过滤，Controller接口返回Json类型结果")
+ @ApiOperation(value = "漏洞场景：GET型与POST型", notes = "原生漏洞场景，未加任何过滤，Controller接口返回JSON类型结果。JSON本身通常不会直接触发XSS，但前端不安全渲染JSON字段时可能触发")
@RequestMapping("/vul1")
@ResponseBody
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
- public R vul1(@ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content) {
- log.info("反射型XSS：" + content);
- return R.ok(content);
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ public R vul1(@ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload) {
+ return handleXssPayload(payload, "反射型-GET/POST型", false);
}
- @ApiOperation(value = "漏洞环境：String", notes = "原生漏洞环境,未加任何过滤，Controller接口返回String")
+ @ApiOperation(value = "漏洞场景：String", notes = "原生漏洞场景,未加任何过滤，Controller接口返回String")
@GetMapping("/vul2")
@ResponseBody
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
- public String vul2(@ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content) {
-
- return content;
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ public String vul2(@ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload) {
+ log.info("[+]XSS-反射型-String型：" + payload);
+ return payload;
}
@SneakyThrows
- @ApiOperation(value = "漏洞环境：Content-Type问题", notes = "Tomcat内置HttpServletResponse，Content-Type导致反射XSS")
+ @ApiOperation(value = "漏洞场景：Content-Type问题", notes = "响应Content-Type决定浏览器解析方式，不可信内容以text/html返回时可能导致反射XSS")
@GetMapping("/vul3")
@ResponseBody
@ApiImplicitParams({
@ApiImplicitParam(name = "type", value = "类型", dataType = "String", paramType = "query", dataTypeClass = String.class),
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
})
- public void vul3(@ApiParam(name = "type", value = "类型", required = true) @RequestParam String type, @ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content, HttpServletResponse response) {
+ public void vul3(@ApiParam(name = "type", value = "类型", required = true) @RequestParam String type, @ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload, HttpServletResponse response) {
switch (type) {
case "html":
- response.getWriter().print(content);
- log.info("反射型XSS，Content-Type：text/html;charset=utf-8：" + content);
+ response.getWriter().print(payload);
+ log.info("[+]XSS-反射性-Content-Type：text/html;charset=utf-8：" + payload);
response.setContentType("text/html;charset=utf-8");
response.getWriter().flush();
break;
case "plain":
- log.info("反射型XSS，Content-Type：text/plain;charset=utf-8：" + content);
- response.getWriter().print(content);
- response.setContentType("text/plain;charset=utf-8"); // response默认返回Content-Type类型是text/plain
+ log.info("[+]XSS-反射性-Content-Type：text/plain;charset=utf-8：" + payload);
+ response.getWriter().print(payload);
+ response.setContentType("text/plain;charset=utf-8");
response.getWriter().flush();
break;
default:
@@ -95,44 +87,51 @@ public void vul3(@ApiParam(name = "type", value = "类型", required = true) @Re
break;
}
}
+
private static final String WHITELIST_REGEX = "^[a-zA-Z0-9_\\s]+$";
private static final Pattern pattern = Pattern.compile(WHITELIST_REGEX);
- @ApiOperation(value = "安全代码：用户输入验证和过滤", notes = "对用户输入的数据进行验证和过滤，确保不包含恶意代码。使用白名单过滤，只允许特定类型的输入，如纯文本或指定格式的数据")
- @RequestMapping("/safe1")
+ @ApiOperation(value = "安全代码：用户输入验证和过滤", notes = "使用白名单限制输入格式，适合约束字段类型；最终仍需根据输出位置进行上下文编码")
+ @GetMapping("/safe1")
@ResponseBody
@ApiImplicitParams({
@ApiImplicitParam(name = "type", value = "类型", dataType = "String", paramType = "query", dataTypeClass = String.class),
@ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
})
- public R safe1(@ApiParam(name = "type", value = "类型", required = true) @RequestParam String type, @ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content) {
+ public R safe1(@ApiParam(name = "type", value = "类型", required = true) @RequestParam String type, @ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload) {
String filterContented = "";
switch (type) {
case "frontEnd":
- filterContented = content; // 前端过滤后传递过来 后端未进行处理(同样存在安全问题)
+ log.info("[-]XSS-反射性-前端白名单过滤：" + payload);
+ filterContented = payload; // 前端过滤后传递过来 后端未进行处理(同样存在安全问题)
break;
case "backEnd":
- Matcher matcher = pattern.matcher(content);
- if (matcher.matches()){
- return R.ok(content);
- }else return R.error("输入内容包含非法字符，请检查输入");
+ log.info("[-]XSS-反射性-后端白名单过滤：" + payload);
+ Matcher matcher = pattern.matcher(payload);
+ if (matcher.matches()) {
+ return R.ok(payload);
+ } else return R.error("输入内容包含非法字符，请检查输入");
}
return R.ok(filterContented);
}
- @ApiOperation(value = "安全代码：内容安全策略-CSP防护", notes = "内容安全策略（Content Security Policy）是一种由浏览器实施的安全机制，旨在减少和防范跨站脚本攻击（XSS）等安全威胁。它通过允许网站管理员定义哪些内容来源是可信任的，从而防止恶意内容的加载和执行")
- @RequestMapping("/safe2")
+
+ @ApiOperation(value = "安全代码：内容安全策略-CSP防护", notes = "内容安全策略（Content Security Policy）是由浏览器实施的额外防护层，可降低恶意脚本加载和执行风险，但不能替代输出编码与安全模板/DOM用法")
+ @GetMapping("/safe2")
@ResponseBody
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
- public String safe2(@ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content,HttpServletResponse response) {
- response.setHeader("Content-Security-Policy","default-src self");
- response.setHeader("Content-Security-Policy-Report-Only", "default-src 'self'; other-uri /xss/reflect/csp-other-endpoint");
- return content;
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ public String safe2(@ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload, HttpServletResponse response) {
+ response.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'self'");
+ response.setHeader("Content-Security-Policy-Report-Only", "default-src 'self'; report-uri /xss/reflect/csp-report-endpoint");
+ log.info("[-]XSS-反射性-内容安全策略-CSP防护：" + payload);
+ return payload;
}
+
@GetMapping("/a-safe2-CSP-front")
- public String safeCSPFront(){
+ public String safeCSPFront() {
return "vul/xss/csp-protect";
}
+
@PostMapping("/csp-report-endpoint")
public void receiveCSPReport(@RequestBody String reportData) {
// 获取当前时间
@@ -152,27 +151,30 @@ public void receiveCSPReport(@RequestBody String reportData) {
// System.err.println("Error writing CSP violation other to file: " + e.getMessage());
// }
}
- @ApiOperation(value = "安全代码：特殊字符实体转义", notes = "特殊字符实体转义是一种将 HTML 中的特殊字符转换为预定义实体表示的过程。这种转义是为了确保在 HTML 页面中正确显示特定字符，同时避免它们被浏览器误解为 HTML 标签或JavaScript代码的一部分，从而导致页面结构混乱或安全漏洞。")
- @RequestMapping("/safe3")
+
+ @ApiOperation(value = "安全代码：HTML正文输出编码", notes = "将HTML正文文本中的特殊字符编码为实体，避免浏览器把不可信数据解析为HTML标签或JavaScript。不同输出上下文需要使用不同编码策略")
+ @GetMapping("/safe3")
@ResponseBody
@ApiImplicitParams({
@ApiImplicitParam(name = "type", value = "类型", dataType = "String", paramType = "query", dataTypeClass = String.class),
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
})
- public R safe3(@ApiParam(name = "type", value = "类型", required = true) @RequestParam String type, @ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content) {
+ public R safe3(@ApiParam(name = "type", value = "类型", required = true) @RequestParam String type, @ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload) {
String filterContented = "";
- switch (type){
+ switch (type) {
case "manual":
- content = StringUtils.replace(content, "&", "&");
- content = StringUtils.replace(content, "<", "<");
- content = StringUtils.replace(content, ">", ">");
- content = StringUtils.replace(content, "\"", """);
- content = StringUtils.replace(content, "'", "'");
- content = StringUtils.replace(content, "/", "/");
- filterContented = content;
+ payload = StringUtils.replace(payload, "&", "&");
+ payload = StringUtils.replace(payload, "<", "<");
+ payload = StringUtils.replace(payload, ">", ">");
+ payload = StringUtils.replace(payload, "\"", """);
+ payload = StringUtils.replace(payload, "'", "'");
+ payload = StringUtils.replace(payload, "/", "/");
+ filterContented = payload;
+ log.info("[-]XSS-反射型-HTML正文输出编码-手动编码：" + payload);
break;
case "spring":
- filterContented = HtmlUtils.htmlEscape(content);
+ filterContented = HtmlUtils.htmlEscape(payload);
+ log.info("[-]XSS-反射型-HTML正文输出编码-Spring框架：" + payload);
break;
default:
return R.error("参数输入有误！");
@@ -180,11 +182,11 @@ public R safe3(@ApiParam(name = "type", value = "类型", required = true) @Requ
return R.ok(filterContented);
}
- @ApiOperation(value = "安全代码：HttpOnly配置", notes = "HttpOnly是HTTP响应头属性，用于增强Web应用程序安全性。它防止客户端脚本访问(只能通过http/https协议访问)带有HttpOnly标记的 cookie，从而减少跨站点脚本攻击（XSS）的风险。")
+ @ApiOperation(value = "安全代码：HttpOnly配置", notes = "HttpOnly可以阻止客户端脚本直接读取带有该属性的Cookie，降低XSS窃取Cookie的影响，但不能修复XSS本身")
@RequestMapping(value = "/safe4", method = RequestMethod.GET)
@ResponseBody
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
- public R safe4(@ApiParam(name = "content", value = "请求参数", required = true) String content, HttpServletRequest request,HttpServletResponse response) {
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ public R safe4(@ApiParam(name = "payload", value = "请求参数", required = true) String payload, HttpServletRequest request, HttpServletResponse response) {
Cookie cookie = request.getCookies()[0];
cookie.setHttpOnly(true); // 设置为 HttpOnly
@@ -192,6 +194,6 @@ public R safe4(@ApiParam(name = "content", value = "请求参数", required = tr
cookie.setPath("/");
response.addCookie(cookie);
- return R.ok("已设置httponly(有效期10分钟)，请打开控制台查看cookie属性："+content);
+ return R.ok("已设置httponly(有效期10分钟)，请打开控制台查看cookie属性：" + payload);
}
}
diff --git a/src/main/java/top/whgojp/modules/xss/controller/StoreController.java b/src/main/java/top/whgojp/modules/xss/controller/StoreController.java
index 30dd887..1ddb25d 100644
--- a/src/main/java/top/whgojp/modules/xss/controller/StoreController.java
+++ b/src/main/java/top/whgojp/modules/xss/controller/StoreController.java
@@ -45,14 +45,14 @@ public String xssStore() {
return "vul/xss/store";
}
- @ApiOperation(value = "漏洞环境：原生无过滤", notes = "原生漏洞环境,未加任何过滤，将用户输入存储到数据库中")
- @RequestMapping("/vul")
+ @ApiOperation(value = "漏洞场景：原生无过滤", notes = "原生漏洞场景，未加任何过滤，将用户输入和User-Agent持久化；后续页面不安全渲染时触发存储型XSS")
+ @PostMapping("/vul")
@ResponseBody
- @ApiImplicitParam(name = "content", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
- public R vul(@ApiParam(name = "content", value = "请求参数", required = true) @RequestParam String content,HttpServletRequest request) {
- log.info("存储型XSS：" + content);
+ @ApiImplicitParam(name = "payload", value = "请求参数", dataType = "String", paramType = "query", dataTypeClass = String.class)
+ public R vul(@ApiParam(name = "payload", value = "请求参数", required = true) @RequestParam String payload,HttpServletRequest request) {
+ log.info("[+]XSS-存储性-原生无过滤：" + payload);
String ua = request.getHeader("User-Agent");
- final int code = xssService.insertOne(content,ua);
+ final int code = xssService.insertOne(payload,ua);
if (code == 1) {
log.info("插入数据成功！");
return R.ok("插入数据成功！");
diff --git a/src/main/java/top/whgojp/modules/xss/controller/UEditorController.java b/src/main/java/top/whgojp/modules/xss/controller/UEditorController.java
index 0c4546a..8d9b938 100644
--- a/src/main/java/top/whgojp/modules/xss/controller/UEditorController.java
+++ b/src/main/java/top/whgojp/modules/xss/controller/UEditorController.java
@@ -46,14 +46,8 @@ public String ueditor() {
public void getConfigInfo(HttpServletRequest request, HttpServletResponse response) {
response.setContentType("application/json");
- String rootPath = "";
- // 判断当前系统是否是Windows系统
- if (isWindowsSystem()) {
- rootPath = ClassUtils.getDefaultClassLoader().getResource("").getPath() + "static/ueditor/jsp";
- } else {
- // 将config.json文件放在jar包同级目录下
- rootPath = "/Users/whgojp/Desktop/Security/JAVA/JavaSecLab/src/main/resources/static/lib/ueditor/jsp";
- }
+ String rootPath = Objects.requireNonNull(ClassUtils.getDefaultClassLoader().getResource("")).getPath()
+ + "static/lib/ueditor/jsp";
log.info("rootPath：{}", rootPath);
try {
response.setCharacterEncoding("UTF-8");
diff --git a/src/main/java/top/whgojp/modules/xss/controller/base/XssBaseController.java b/src/main/java/top/whgojp/modules/xss/controller/base/XssBaseController.java
new file mode 100644
index 0000000..4ad2018
--- /dev/null
+++ b/src/main/java/top/whgojp/modules/xss/controller/base/XssBaseController.java
@@ -0,0 +1,41 @@
+package top.whgojp.modules.xss.controller.base;
+
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.thymeleaf.util.StringUtils;
+import top.whgojp.common.utils.CheckUserInput;
+import top.whgojp.common.utils.R;
+
+import javax.servlet.http.HttpServletRequest;
+
+@Slf4j
+public abstract class XssBaseController {
+ @Autowired
+ protected CheckUserInput checkUserInput;
+
+ protected R handleXssPayload(String payload, String type, boolean enableFilter) {
+ if (StringUtils.isEmpty(payload)) {
+ return R.error("参数不能为空");
+ }
+
+ log.info("[+]XSS-{}-收到payload：{}", type, payload);
+
+ if (enableFilter) {
+ String filteredPayload = checkUserInput.filter(payload);
+ log.info("[+]XSS-{}-过滤后：{}", type, filteredPayload);
+ return R.ok(filteredPayload);
+ }
+
+ return R.ok(payload);
+ }
+
+ protected String getUserAgent(HttpServletRequest request) {
+ String ua = request.getHeader("User-Agent");
+ return StringUtils.isEmpty(ua) ? "unknown" : ua;
+ }
+
+ protected boolean isValidView(String view) {
+ return !StringUtils.isEmpty(view) &&
+ (view.equals("vul") || view.equals("safe"));
+ }
+}
diff --git a/src/main/java/top/whgojp/modules/xss/service/impl/XssServiceImpl.java b/src/main/java/top/whgojp/modules/xss/service/impl/XssServiceImpl.java
index 034a024..164e309 100644
--- a/src/main/java/top/whgojp/modules/xss/service/impl/XssServiceImpl.java
+++ b/src/main/java/top/whgojp/modules/xss/service/impl/XssServiceImpl.java
@@ -8,7 +8,6 @@
import top.whgojp.modules.xss.service.XssService;
import top.whgojp.modules.xss.mapper.XssMapper;
import org.springframework.stereotype.Service;
-
import java.util.List;
/**
@@ -18,30 +17,42 @@
*/
@Slf4j
@Service
-public class XssServiceImpl extends ServiceImpl
- implements XssService{
+public class XssServiceImpl extends ServiceImpl implements XssService {
@Autowired
private XssMapper xssMapper;
@Override
public int insertOne(String content, String ua) {
- final int code = xssMapper.insertAll(content,ua,DateUtil.now());
- return code;
+ try {
+ log.info("插入XSS记录 - content: {}, ua: {}", content, ua);
+ final int code = xssMapper.insertAll(content,ua,DateUtil.now());
+ return code;
+ } catch (Exception e) {
+ log.error("插入XSS记录失败", e);
+ return 0;
+ }
}
@Override
public List selectAll() {
- List xssList = xssMapper.selectAll();
- return xssList;
+ try {
+ List xssList = xssMapper.selectAll();
+ return xssList;
+ } catch (Exception e) {
+ log.error("查询XSS记录失败", e);
+ return null;
+ }
}
@Override
public int deleteById(int id) {
- int i = xssMapper.deleteById(id);
- return i;
+ try {
+ log.info("删除XSS记录 - id: {}", id);
+ int i = xssMapper.deleteById(id);
+ return i;
+ } catch (Exception e) {
+ log.error("删除XSS记录失败 - id: {}", id, e);
+ return 0;
+ }
}
}
-
-
-
-
diff --git a/src/main/java/top/whgojp/modules/xxe/controller/XXEController.java b/src/main/java/top/whgojp/modules/xxe/controller/XXEController.java
index 8c175bd..7f546b9 100644
--- a/src/main/java/top/whgojp/modules/xxe/controller/XXEController.java
+++ b/src/main/java/top/whgojp/modules/xxe/controller/XXEController.java
@@ -17,6 +17,7 @@
import javax.xml.bind.JAXBContext;
import javax.xml.bind.Unmarshaller;
+import javax.xml.XMLConstants;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import javax.xml.parsers.SAXParser;
@@ -73,7 +74,7 @@ public void characters(char[] ch, int start, int length) {
/**
- * javax.xml.parsers.SAXParser 是 XMLReader 的替代品，它提供了更多的安全措施，例如默认禁用 DTD 和外部实体的声明，如果需要使用 DTD 或外部实体，可以手动启用它们，并使用相应的安全措施
+ * SAXParser 解析不可信 XML 时同样需要显式关闭 DTD、外部实体和外部 DTD 加载。
*/
@RequestMapping(value = "/vul2")
@ResponseBody
@@ -100,6 +101,19 @@ public void characters(char[] ch, int start, int length) {
}
}
+ @RequestMapping(value = "/vul3")
+ @ResponseBody
+ public String vul3(@RequestParam String payload) {
+ try {
+ DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+ DocumentBuilder builder = factory.newDocumentBuilder();
+ Document document = builder.parse(new InputSource(new StringReader(payload)));
+ return formatXmlText(document.getDocumentElement().getTextContent());
+ } catch (Exception e) {
+ return e.toString();
+ }
+ }
+
// @ApiOperation(value = "vul：xmlbeam")
// @RequestMapping(value = "/xmlbeam")
@@ -215,6 +229,8 @@ public String safe1(@RequestParam String payload) {
xmlReader.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
xmlReader.setFeature("http://xml.org/sax/features/external-general-entities", false);
xmlReader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ xmlReader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+ xmlReader.setEntityResolver((publicId, systemId) -> new InputSource(new StringReader("")));
StringWriter stringWriter = new StringWriter();
xmlReader.setContentHandler(new DefaultHandler() {
public void characters(char[] ch, int start, int length) {
@@ -234,6 +250,29 @@ public void characters(char[] ch, int start, int length) {
}
}
+ @RequestMapping(value = "/safe3")
+ @ResponseBody
+ public String safe3(@RequestParam String payload) {
+ try {
+ DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+ factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+ factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ factory.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+ factory.setXIncludeAware(false);
+ factory.setExpandEntityReferences(false);
+ setAttributeIfSupported(factory, XMLConstants.ACCESS_EXTERNAL_DTD, "");
+ setAttributeIfSupported(factory, XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+
+ DocumentBuilder builder = factory.newDocumentBuilder();
+ builder.setEntityResolver((publicId, systemId) -> new InputSource(new StringReader("")));
+ Document document = builder.parse(new InputSource(new StringReader(payload)));
+ return formatXmlText(document.getDocumentElement().getTextContent());
+ } catch (Exception e) {
+ return e.toString();
+ }
+ }
+
@RequestMapping(value = "/safe2")
@ResponseBody
public String safe2(@RequestParam String payload) {
@@ -246,6 +285,20 @@ public String safe2(@RequestParam String payload) {
return "[-]XML内容安全";
}
+ private String formatXmlText(String text) {
+ if (text == null) {
+ return "";
+ }
+ return text.replace("\n", "
-
-
-
-
-
- logId,username,optionName,
- optionTerminal,optionIp,optionTime
-
-
diff --git a/src/main/resources/mapper/SqliMapper.xml b/src/main/resources/mapper/SqliMapper.xml
index b27d600..a977910 100644
--- a/src/main/resources/mapper/SqliMapper.xml
+++ b/src/main/resources/mapper/SqliMapper.xml
@@ -14,8 +14,8 @@
id,username,password
insert into sqli (id,username,password) values (#{id,jdbcType=INTEGER},#{username,jdbcType=VARCHAR},#{password,jdbcType=VARCHAR})
@@ -33,7 +33,7 @@
-
+
SELECT * FROM sqli
@@ -41,14 +41,14 @@
-
+
SELECT * FROM sqli
ORDER BY #{field}
-
+
SELECT * FROM sqli
diff --git a/src/main/resources/static/api/clear.json b/src/main/resources/static/api/clear.json
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/api/init.json b/src/main/resources/static/api/init.json
old mode 100644
new mode 100755
index cc214e8..a1cd396
--- a/src/main/resources/static/api/init.json
+++ b/src/main/resources/static/api/init.json
@@ -28,13 +28,13 @@
"target": "_self",
"child": [
{
- "title": "漏洞环境",
+ "title": "漏洞场景",
"href": "xss/reflect/vul",
"icon": "iconfont icon-bug",
"target": "_self"
},
{
- "title": "安全环境",
+ "title": "安全场景",
"href": "xss/reflect/safe",
"icon": "iconfont icon-anquan",
"target": "_self"
@@ -74,13 +74,13 @@
"target": "_self",
"child": [
{
- "title": "漏洞环境",
+ "title": "漏洞场景",
"href": "sqli/jdbc/jdbcVul",
"icon": "iconfont icon-bug",
"target": "_self"
},
{
- "title": "安全代码",
+ "title": "安全场景",
"href": "sqli/jdbc/jdbcSafe",
"icon": "iconfont icon-anquan",
"target": "_self"
@@ -101,13 +101,13 @@
},
{
"title": "Hibernate",
- "href": "",
+ "href": "sqli/hibernate",
"icon": "iconfont icon-Hivebiao",
"target": "_self"
},
{
"title": "JPA",
- "href": "",
+ "href": "sqli/jpa",
"icon": "iconfont icon-spring",
"target": "_self"
}
@@ -158,13 +158,13 @@
"target": "_self",
"child": [
{
- "title": "漏洞环境",
+ "title": "漏洞场景",
"href": "xxe/vul",
"icon": "iconfont icon-bug",
"target": "_self"
},
{
- "title": "安全环境",
+ "title": "安全场景",
"href": "xxe/safe",
"icon": "iconfont icon-anquan",
"target": "_self"
@@ -245,9 +245,35 @@
},
{
"title": "支付漏洞",
- "href": "",
+ "href": "logic/pay",
"icon": "iconfont icon-zhifu",
"target": "_self"
+ },
+ {
+ "title": "并发安全",
+ "href": "logic/concurrent",
+ "icon": "iconfont icon-gaobingfa",
+ "target": "_self"
+ },
+ {
+ "title": "验证码安全",
+ "href": "",
+ "icon": "iconfont icon-yanzhengma1",
+ "target": "_self",
+ "child": [
+ {
+ "title": "图形验证码",
+ "href": "logic/captcha/graphic",
+ "icon": "iconfont icon-yanzhengma",
+ "target": "_self"
+ },
+ {
+ "title": "短信验证码",
+ "href": "logic/captcha/sms",
+ "icon": "iconfont icon-duanxin",
+ "target": "_self"
+ }
+ ]
}
]
},
@@ -264,13 +290,13 @@
"target": "_self",
"child": [
{
- "title": "漏洞环境",
+ "title": "漏洞场景",
"href": "other/URLRedirect/vul",
"icon": "iconfont icon-bug",
"target": "_self"
},
{
- "title": "安全环境",
+ "title": "安全场景",
"href": "other/URLRedirect/safe",
"icon": "iconfont icon-anquan",
"target": "_self"
@@ -328,7 +354,40 @@
"target": "_self"
}
]
+ },
+ {
+ "title": "登录对抗",
+ "href": "",
+ "icon": "iconfont icon-denglukuang",
+ "target": "_self",
+ "child": [
+ {
+ "title": "账号安全",
+ "href": "/loginconfront/account",
+ "icon": "iconfont icon-zhanghao",
+ "target": "_self"
+ },
+ {
+ "title": "登录绕过",
+ "href": "/loginconfront/bypass",
+ "icon": "iconfont icon-mimazhaohui",
+ "target": "_self"
+ },
+ {
+ "title": "JS逆向",
+ "href": "/loginconfront/reverse",
+ "icon": "iconfont icon-JS",
+ "target": "_self"
+ },
+ {
+ "title": "凭证安全",
+ "href": "/loginconfront/credential",
+ "icon": "iconfont icon-quanxianweizao",
+ "target": "_self"
+ }
+ ]
}
+
]
},
{
@@ -419,7 +478,8 @@
}
]
}
+
]
}
]
-}
\ No newline at end of file
+}
diff --git a/src/main/resources/static/api/menus.json b/src/main/resources/static/api/menus.json
deleted file mode 100644
index e14d00e..0000000
--- a/src/main/resources/static/api/menus.json
+++ /dev/null
@@ -1,254 +0,0 @@
-{
- "code": 0,
- "msg": "",
- "count": 19,
- "data": [
- {
- "authorityId": 1,
- "authorityName": "系统管理",
- "orderNumber": 1,
- "menuUrl": null,
- "menuIcon": "layui-icon-set",
- "createTime": "2018/06/29 11:05:41",
- "authority": null,
- "checked": 0,
- "updateTime": "2018/07/13 09:13:42",
- "isMenu": 0,
- "parentId": -1
- },
- {
- "authorityId": 2,
- "authorityName": "用户管理",
- "orderNumber": 2,
- "menuUrl": "system/user",
- "menuIcon": null,
- "createTime": "2018/06/29 11:05:41",
- "authority": null,
- "checked": 0,
- "updateTime": "2018/07/13 09:13:42",
- "isMenu": 0,
- "parentId": 1
- },
- {
- "authorityId": 3,
- "authorityName": "查询用户",
- "orderNumber": 3,
- "menuUrl": "",
- "menuIcon": "",
- "createTime": "2018/07/21 13:54:16",
- "authority": "user:view",
- "checked": 0,
- "updateTime": "2018/07/21 13:54:16",
- "isMenu": 1,
- "parentId": 2
- },
- {
- "authorityId": 4,
- "authorityName": "添加用户",
- "orderNumber": 4,
- "menuUrl": null,
- "menuIcon": null,
- "createTime": "2018/06/29 11:05:41",
- "authority": "user:add",
- "checked": 0,
- "updateTime": "2018/07/13 09:13:42",
- "isMenu": 1,
- "parentId": 2
- },
- {
- "authorityId": 5,
- "authorityName": "修改用户",
- "orderNumber": 5,
- "menuUrl": null,
- "menuIcon": null,
- "createTime": "2018/06/29 11:05:41",
- "authority": "user:edit",
- "checked": 0,
- "updateTime": "2018/07/13 09:13:42",
- "isMenu": 1,
- "parentId": 2
- },
- {
- "authorityId": 6,
- "authorityName": "删除用户",
- "orderNumber": 6,
- "menuUrl": null,
- "menuIcon": null,
- "createTime": "2018/06/29 11:05:41",
- "authority": "user:delete",
- "checked": 0,
- "updateTime": "2018/07/13 09:13:42",
- "isMenu": 1,
- "parentId": 2
- },
- {
- "authorityId": 7,
- "authorityName": "角色管理",
- "orderNumber": 7,
- "menuUrl": "system/role",
- "menuIcon": null,
- "createTime": "2018/06/29 11:05:41",
- "authority": null,
- "checked": 0,
- "updateTime": "2018/07/13 09:13:42",
- "isMenu": 0,
- "parentId": 1
- },
- {
- "authorityId": 8,
- "authorityName": "查询角色",
- "orderNumber": 8,
- "menuUrl": "",
- "menuIcon": "",
- "createTime": "2018/07/21 13:54:59",
- "authority": "role:view",
- "checked": 0,
- "updateTime": "2018/07/21 13:54:58",
- "isMenu": 1,
- "parentId": 7
- },
- {
- "authorityId": 9,
- "authorityName": "添加角色",
- "orderNumber": 9,
- "menuUrl": "",
- "menuIcon": "",
- "createTime": "2018/06/29 11:05:41",
- "authority": "role:add",
- "checked": 0,
- "updateTime": "2018/07/13 09:13:42",
- "isMenu": 1,
- "parentId": 7
- },
- {
- "authorityId": 10,
- "authorityName": "修改角色",
- "orderNumber": 10,
- "menuUrl": "",
- "menuIcon": "",
- "createTime": "2018/06/29 11:05:41",
- "authority": "role:edit",
- "checked": 0,
- "updateTime": "2018/07/13 09:13:42",
- "isMenu": 1,
- "parentId": 7
- },
- {
- "authorityId": 11,
- "authorityName": "删除角色",
- "orderNumber": 11,
- "menuUrl": "",
- "menuIcon": "",
- "createTime": "2018/06/29 11:05:41",
- "authority": "role:delete",
- "checked": 0,
- "updateTime": "2018/07/13 09:13:42",
- "isMenu": 1,
- "parentId": 7
- },
- {
- "authorityId": 12,
- "authorityName": "角色权限管理",
- "orderNumber": 12,
- "menuUrl": "",
- "menuIcon": "",
- "createTime": "2018/06/29 11:05:41",
- "authority": "role:auth",
- "checked": 0,
- "updateTime": "2018/07/13 15:27:18",
- "isMenu": 1,
- "parentId": 7
- },
- {
- "authorityId": 13,
- "authorityName": "权限管理",
- "orderNumber": 13,
- "menuUrl": "system/authorities",
- "menuIcon": null,
- "createTime": "2018/06/29 11:05:41",
- "authority": null,
- "checked": 0,
- "updateTime": "2018/07/13 15:45:13",
- "isMenu": 0,
- "parentId": 1
- },
- {
- "authorityId": 14,
- "authorityName": "查询权限",
- "orderNumber": 14,
- "menuUrl": "",
- "menuIcon": "",
- "createTime": "2018/07/21 13:55:57",
- "authority": "authorities:view",
- "checked": 0,
- "updateTime": "2018/07/21 13:55:56",
- "isMenu": 1,
- "parentId": 13
- },
- {
- "authorityId": 15,
- "authorityName": "添加权限",
- "orderNumber": 15,
- "menuUrl": "",
- "menuIcon": "",
- "createTime": "2018/06/29 11:05:41",
- "authority": "authorities:add",
- "checked": 0,
- "updateTime": "2018/06/29 11:05:41",
- "isMenu": 1,
- "parentId": 13
- },
- {
- "authorityId": 16,
- "authorityName": "修改权限",
- "orderNumber": 16,
- "menuUrl": "",
- "menuIcon": "",
- "createTime": "2018/07/13 09:13:42",
- "authority": "authorities:edit",
- "checked": 0,
- "updateTime": "2018/07/13 09:13:42",
- "isMenu": 1,
- "parentId": 13
- },
- {
- "authorityId": 17,
- "authorityName": "删除权限",
- "orderNumber": 17,
- "menuUrl": "",
- "menuIcon": "",
- "createTime": "2018/06/29 11:05:41",
- "authority": "authorities:delete",
- "checked": 0,
- "updateTime": "2018/06/29 11:05:41",
- "isMenu": 1,
- "parentId": 13
- },
- {
- "authorityId": 18,
- "authorityName": "登录日志",
- "orderNumber": 18,
- "menuUrl": "system/loginRecord",
- "menuIcon": null,
- "createTime": "2018/06/29 11:05:41",
- "authority": null,
- "checked": 0,
- "updateTime": "2018/06/29 11:05:41",
- "isMenu": 0,
- "parentId": 1
- },
- {
- "authorityId": 19,
- "authorityName": "查询登录日志",
- "orderNumber": 19,
- "menuUrl": "",
- "menuIcon": "",
- "createTime": "2018/07/21 13:56:43",
- "authority": "loginRecord:view",
- "checked": 0,
- "updateTime": "2018/07/21 13:56:43",
- "isMenu": 1,
- "parentId": 18
- }
- ]
-}
\ No newline at end of file
diff --git a/src/main/resources/static/api/table.json b/src/main/resources/static/api/table.json
deleted file mode 100644
index 7bda61b..0000000
--- a/src/main/resources/static/api/table.json
+++ /dev/null
@@ -1,127 +0,0 @@
-{
- "code": 0,
- "msg": "",
- "count": 1000,
- "data": [
- {
- "id": 10000,
- "username": "user-0",
- "sex": "女",
- "city": "城市-0",
- "sign": "签名-0",
- "experience": 255,
- "logins": 24,
- "wealth": 82830700,
- "classify": "作家",
- "score": 57
- },
- {
- "id": 10001,
- "username": "user-1",
- "sex": "男",
- "city": "城市-1",
- "sign": "签名-1",
- "experience": 884,
- "logins": 58,
- "wealth": 64928690,
- "classify": "词人",
- "score": 27
- },
- {
- "id": 10002,
- "username": "user-2",
- "sex": "女",
- "city": "城市-2",
- "sign": "签名-2",
- "experience": 650,
- "logins": 77,
- "wealth": 6298078,
- "classify": "酱油",
- "score": 31
- },
- {
- "id": 10003,
- "username": "user-3",
- "sex": "女",
- "city": "城市-3",
- "sign": "签名-3",
- "experience": 362,
- "logins": 157,
- "wealth": 37117017,
- "classify": "诗人",
- "score": 68
- },
- {
- "id": 10004,
- "username": "user-4",
- "sex": "男",
- "city": "城市-4",
- "sign": "签名-4",
- "experience": 807,
- "logins": 51,
- "wealth": 76263262,
- "classify": "作家",
- "score": 6
- },
- {
- "id": 10005,
- "username": "user-5",
- "sex": "女",
- "city": "城市-5",
- "sign": "签名-5",
- "experience": 173,
- "logins": 68,
- "wealth": 60344147,
- "classify": "作家",
- "score": 87
- },
- {
- "id": 10006,
- "username": "user-6",
- "sex": "女",
- "city": "城市-6",
- "sign": "签名-6",
- "experience": 982,
- "logins": 37,
- "wealth": 57768166,
- "classify": "作家",
- "score": 34
- },
- {
- "id": 10007,
- "username": "user-7",
- "sex": "男",
- "city": "城市-7",
- "sign": "签名-7",
- "experience": 727,
- "logins": 150,
- "wealth": 82030578,
- "classify": "作家",
- "score": 28
- },
- {
- "id": 10008,
- "username": "user-8",
- "sex": "男",
- "city": "城市-8",
- "sign": "签名-8",
- "experience": 951,
- "logins": 133,
- "wealth": 16503371,
- "classify": "词人",
- "score": 14
- },
- {
- "id": 10009,
- "username": "user-9",
- "sex": "女",
- "city": "城市-9",
- "sign": "签名-9",
- "experience": 484,
- "logins": 25,
- "wealth": 86801934,
- "classify": "词人",
- "score": 75
- }
- ]
-}
\ No newline at end of file
diff --git a/src/main/resources/static/api/tableSelect.json b/src/main/resources/static/api/tableSelect.json
deleted file mode 100644
index 37fb0ed..0000000
--- a/src/main/resources/static/api/tableSelect.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
- "code": 0,
- "msg": "",
- "count": 16,
- "data": [
- { "id":"001", "username":"张玉林", "sex":"女" },
- { "id":"002", "username":"刘晓军", "sex":"男" },
- { "id":"003", "username":"张恒", "sex":"男" },
- { "id":"004", "username":"朱一", "sex":"男" },
- { "id":"005", "username":"刘佳能", "sex":"女" },
- { "id":"006", "username":"晓梅", "sex":"女" },
- { "id":"007", "username":"马冬梅", "sex":"女" },
- { "id":"008", "username":"刘晓庆", "sex":"女" },
- { "id":"009", "username":"刘晓庆", "sex":"女" },
- { "id":"010", "username":"刘晓庆", "sex":"女" },
- { "id":"011", "username":"刘晓庆", "sex":"女" },
- { "id":"012", "username":"刘晓庆", "sex":"女" },
- { "id":"013", "username":"刘晓庆", "sex":"女" },
- { "id":"014", "username":"刘晓庆", "sex":"女" },
- { "id":"015", "username":"刘晓庆", "sex":"女" },
- { "id":"016", "username":"刘晓庆", "sex":"女" }
- ]
-}
\ No newline at end of file
diff --git a/src/main/resources/static/api/upload.json b/src/main/resources/static/api/upload.json
deleted file mode 100644
index 691902d..0000000
--- a/src/main/resources/static/api/upload.json
+++ /dev/null
@@ -1,10 +0,0 @@
-{
- "code": 1,
- "msg": "上传成功",
- "data": {
- "url": [
- "../images/logo.png",
- "../images/captcha.jpg"
- ]
- }
-}
diff --git a/src/main/resources/static/css/juejin.css b/src/main/resources/static/css/juejin.css
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/css/juejinsafe.css b/src/main/resources/static/css/juejinsafe.css
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/css/layuimini.css b/src/main/resources/static/css/layuimini.css
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/css/public.css b/src/main/resources/static/css/public.css
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/css/themes/default.css b/src/main/resources/static/css/themes/default.css
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/images/bg.jpg b/src/main/resources/static/images/bg.jpg
deleted file mode 100644
index 82b853e..0000000
Binary files a/src/main/resources/static/images/bg.jpg and /dev/null differ
diff --git a/src/main/resources/static/images/home.png b/src/main/resources/static/images/home.png
deleted file mode 100644
index 348ff27..0000000
Binary files a/src/main/resources/static/images/home.png and /dev/null differ
diff --git a/src/main/resources/static/images/icon-login.png b/src/main/resources/static/images/icon-login.png
deleted file mode 100644
index 1db2f96..0000000
Binary files a/src/main/resources/static/images/icon-login.png and /dev/null differ
diff --git a/src/main/resources/static/images/loginbg.png b/src/main/resources/static/images/loginbg.png
deleted file mode 100644
index 675c74b..0000000
Binary files a/src/main/resources/static/images/loginbg.png and /dev/null differ
diff --git a/src/main/resources/static/images/vul/components/deserialize.jpg b/src/main/resources/static/images/vul/components/deserialize.jpg
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/images/vul/components/fastjson.png b/src/main/resources/static/images/vul/components/fastjson.png
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/images/vul/components/log4j.png b/src/main/resources/static/images/vul/components/log4j.png
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/images/vul/components/shiro.png b/src/main/resources/static/images/vul/components/shiro.png
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/images/vul/crossOrigin/sameOrign.png b/src/main/resources/static/images/vul/crossOrigin/sameOrign.png
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/images/vul/csrf/csrf.png b/src/main/resources/static/images/vul/csrf/csrf.png
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/images/vul/dos/dos.jpeg b/src/main/resources/static/images/vul/dos/dos.jpeg
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/images/vul/idor/idor.png b/src/main/resources/static/images/vul/idor/idor.png
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/images/vul/jdbc/jdbc.png b/src/main/resources/static/images/vul/jdbc/jdbc.png
new file mode 100755
index 0000000..a4cf54f
Binary files /dev/null and b/src/main/resources/static/images/vul/jdbc/jdbc.png differ
diff --git a/src/main/resources/static/images/vul/memshell/filter.png b/src/main/resources/static/images/vul/memshell/filter.png
new file mode 100755
index 0000000..8b13789
--- /dev/null
+++ b/src/main/resources/static/images/vul/memshell/filter.png
@@ -0,0 +1 @@
+
diff --git a/src/main/resources/static/images/vul/memshell/listener.png b/src/main/resources/static/images/vul/memshell/listener.png
new file mode 100755
index 0000000..8b13789
--- /dev/null
+++ b/src/main/resources/static/images/vul/memshell/listener.png
@@ -0,0 +1 @@
+
diff --git a/src/main/resources/static/images/vul/memshell/servlet.png b/src/main/resources/static/images/vul/memshell/servlet.png
new file mode 100755
index 0000000..8b13789
--- /dev/null
+++ b/src/main/resources/static/images/vul/memshell/servlet.png
@@ -0,0 +1 @@
+
diff --git a/src/main/resources/static/images/vul/ssrf/ssrf.jpg b/src/main/resources/static/images/vul/ssrf/ssrf.jpg
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/images/vul/xss/dom.png b/src/main/resources/static/images/vul/xss/dom.png
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/images/vul/xss/reflect.png b/src/main/resources/static/images/vul/xss/reflect.png
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/images/vul/xss/store.jpg b/src/main/resources/static/images/vul/xss/store.jpg
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/images/vul/xxe/xxe.png b/src/main/resources/static/images/vul/xxe/xxe.png
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/hackcookie.js b/src/main/resources/static/js/hackcookie.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/header.js b/src/main/resources/static/js/header.js
old mode 100644
new mode 100755
index 0407df9..e7f3afb
--- a/src/main/resources/static/js/header.js
+++ b/src/main/resources/static/js/header.js
@@ -24,4 +24,4 @@ document.writeln("");
document.writeln("");
document.writeln("");
document.writeln("");
-document.writeln("");
+document.writeln("");
diff --git a/src/main/resources/static/js/jquery.request.js b/src/main/resources/static/js/jquery.request.js
old mode 100644
new mode 100755
index f4260aa..8002161
--- a/src/main/resources/static/js/jquery.request.js
+++ b/src/main/resources/static/js/jquery.request.js
@@ -42,7 +42,10 @@ function request (url, method, data = {}, contentType, back){
error: error,
headers: xhr.getAllResponseHeaders()
});
- return typeof back === "function" && back(null);
+ var message = xhr.responseJSON && xhr.responseJSON.msg
+ ? xhr.responseJSON.msg
+ : "请求失败：" + (xhr.status || status) + " " + (error || xhr.statusText || "");
+ return typeof back === "function" && back({code: 1, msg: message});
}
});
};
@@ -57,4 +60,3 @@ function postAjaxRequst (url, data, callBack) {
return typeof callBack == "function" && callBack(res)
})
};
-
diff --git a/src/main/resources/static/js/jsencrypt.min.js b/src/main/resources/static/js/jsencrypt.min.js
new file mode 100755
index 0000000..c2b6b10
--- /dev/null
+++ b/src/main/resources/static/js/jsencrypt.min.js
@@ -0,0 +1,1540 @@
+/*! For license information please see jsencrypt.min.js.LICENSE.txt */
+!function (t, e) {
+ "object" == typeof exports && "object" == typeof module ? module.exports = e() : "function" == typeof define && define.amd ? define([], e) : "object" == typeof exports ? exports.JSEncrypt = e() : t.JSEncrypt = e()
+}(window, (function () {
+ return (() => {
+ "use strict";
+ var t = {
+ 771: (t, e, i) => {
+ function r(t) {
+ return "0123456789abcdefghijklmnopqrstuvwxyz".charAt(t)
+ }
+
+ function n(t, e) {
+ return t & e
+ }
+
+ function s(t, e) {
+ return t | e
+ }
+
+ function o(t, e) {
+ return t ^ e
+ }
+
+ function h(t, e) {
+ return t & ~e
+ }
+
+ function a(t) {
+ if (0 == t) return -1;
+ var e = 0;
+ return 0 == (65535 & t) && (t >>= 16, e += 16), 0 == (255 & t) && (t >>= 8, e += 8), 0 == (15 & t) && (t >>= 4, e += 4), 0 == (3 & t) && (t >>= 2, e += 2), 0 == (1 & t) && ++e, e
+ }
+
+ function u(t) {
+ for (var e = 0; 0 != t;) t &= t - 1, ++e;
+ return e
+ }
+
+ i.d(e, {default: () => nt});
+ var c, f = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+
+ function l(t) {
+ var e, i, r = "";
+ for (e = 0; e + 3 <= t.length; e += 3) i = parseInt(t.substring(e, e + 3), 16), r += f.charAt(i >> 6) + f.charAt(63 & i);
+ for (e + 1 == t.length ? (i = parseInt(t.substring(e, e + 1), 16), r += f.charAt(i << 2)) : e + 2 == t.length && (i = parseInt(t.substring(e, e + 2), 16), r += f.charAt(i >> 2) + f.charAt((3 & i) << 4)); (3 & r.length) > 0;) r += "=";
+ return r
+ }
+
+ function p(t) {
+ var e, i = "", n = 0, s = 0;
+ for (e = 0; e < t.length && "=" != t.charAt(e); ++e) {
+ var o = f.indexOf(t.charAt(e));
+ o < 0 || (0 == n ? (i += r(o >> 2), s = 3 & o, n = 1) : 1 == n ? (i += r(s << 2 | o >> 4), s = 15 & o, n = 2) : 2 == n ? (i += r(s), i += r(o >> 2), s = 3 & o, n = 3) : (i += r(s << 2 | o >> 4), i += r(15 & o), n = 0))
+ }
+ return 1 == n && (i += r(s << 2)), i
+ }
+
+ var g, d = {
+ decode: function (t) {
+ var e;
+ if (void 0 === g) {
+ var i = "= \f\n\r\t \u2028\u2029";
+ for (g = Object.create(null), e = 0; e < 64; ++e) g["ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(e)] = e;
+ for (g["-"] = 62, g._ = 63, e = 0; e < i.length; ++e) g[i.charAt(e)] = -1
+ }
+ var r = [], n = 0, s = 0;
+ for (e = 0; e < t.length; ++e) {
+ var o = t.charAt(e);
+ if ("=" == o) break;
+ if (-1 != (o = g[o])) {
+ if (void 0 === o) throw new Error("Illegal character at offset " + e);
+ n |= o, ++s >= 4 ? (r[r.length] = n >> 16, r[r.length] = n >> 8 & 255, r[r.length] = 255 & n, n = 0, s = 0) : n <<= 6
+ }
+ }
+ switch (s) {
+ case 1:
+ throw new Error("Base64 encoding incomplete: at least 2 bits missing");
+ case 2:
+ r[r.length] = n >> 10;
+ break;
+ case 3:
+ r[r.length] = n >> 16, r[r.length] = n >> 8 & 255
+ }
+ return r
+ },
+ re: /-----BEGIN [^-]+-----([A-Za-z0-9+\/=\s]+)-----END [^-]+-----|begin-base64[^\n]+\n([A-Za-z0-9+\/=\s]+)====/,
+ unarmor: function (t) {
+ var e = d.re.exec(t);
+ if (e) if (e[1]) t = e[1]; else {
+ if (!e[2]) throw new Error("RegExp out of sync");
+ t = e[2]
+ }
+ return d.decode(t)
+ }
+ }, v = 1e13, m = function () {
+ function t(t) {
+ this.buf = [+t || 0]
+ }
+
+ return t.prototype.mulAdd = function (t, e) {
+ var i, r, n = this.buf, s = n.length;
+ for (i = 0; i < s; ++i) (r = n[i] * t + e) < v ? e = 0 : r -= (e = 0 | r / v) * v, n[i] = r;
+ e > 0 && (n[i] = e)
+ }, t.prototype.sub = function (t) {
+ var e, i, r = this.buf, n = r.length;
+ for (e = 0; e < n; ++e) (i = r[e] - t) < 0 ? (i += v, t = 1) : t = 0, r[e] = i;
+ for (; 0 === r[r.length - 1];) r.pop()
+ }, t.prototype.toString = function (t) {
+ if (10 != (t || 10)) throw new Error("only base 10 is supported");
+ for (var e = this.buf, i = e[e.length - 1].toString(), r = e.length - 2; r >= 0; --r) i += (v + e[r]).toString().substring(1);
+ return i
+ }, t.prototype.valueOf = function () {
+ for (var t = this.buf, e = 0, i = t.length - 1; i >= 0; --i) e = e * v + t[i];
+ return e
+ }, t.prototype.simplify = function () {
+ var t = this.buf;
+ return 1 == t.length ? t[0] : this
+ }, t
+ }(),
+ y = /^(\d\d)(0[1-9]|1[0-2])(0[1-9]|[12]\d|3[01])([01]\d|2[0-3])(?:([0-5]\d)(?:([0-5]\d)(?:[.,](\d{1,3}))?)?)?(Z|[-+](?:[0]\d|1[0-2])([0-5]\d)?)?$/,
+ b = /^(\d\d\d\d)(0[1-9]|1[0-2])(0[1-9]|[12]\d|3[01])([01]\d|2[0-3])(?:([0-5]\d)(?:([0-5]\d)(?:[.,](\d{1,3}))?)?)?(Z|[-+](?:[0]\d|1[0-2])([0-5]\d)?)?$/;
+
+ function T(t, e) {
+ return t.length > e && (t = t.substring(0, e) + "…"), t
+ }
+
+ var S, E = function () {
+ function t(e, i) {
+ this.hexDigits = "0123456789ABCDEF", e instanceof t ? (this.enc = e.enc, this.pos = e.pos) : (this.enc = e, this.pos = i)
+ }
+
+ return t.prototype.get = function (t) {
+ if (void 0 === t && (t = this.pos++), t >= this.enc.length) throw new Error("Requesting byte offset " + t + " on a stream of length " + this.enc.length);
+ return "string" == typeof this.enc ? this.enc.charCodeAt(t) : this.enc[t]
+ }, t.prototype.hexByte = function (t) {
+ return this.hexDigits.charAt(t >> 4 & 15) + this.hexDigits.charAt(15 & t)
+ }, t.prototype.hexDump = function (t, e, i) {
+ for (var r = "", n = t; n < e; ++n) if (r += this.hexByte(this.get(n)), !0 !== i) switch (15 & n) {
+ case 7:
+ r += " ";
+ break;
+ case 15:
+ r += "\n";
+ break;
+ default:
+ r += " "
+ }
+ return r
+ }, t.prototype.isASCII = function (t, e) {
+ for (var i = t; i < e; ++i) {
+ var r = this.get(i);
+ if (r < 32 || r > 176) return !1
+ }
+ return !0
+ }, t.prototype.parseStringISO = function (t, e) {
+ for (var i = "", r = t; r < e; ++r) i += String.fromCharCode(this.get(r));
+ return i
+ }, t.prototype.parseStringUTF = function (t, e) {
+ for (var i = "", r = t; r < e;) {
+ var n = this.get(r++);
+ i += n < 128 ? String.fromCharCode(n) : n > 191 && n < 224 ? String.fromCharCode((31 & n) << 6 | 63 & this.get(r++)) : String.fromCharCode((15 & n) << 12 | (63 & this.get(r++)) << 6 | 63 & this.get(r++))
+ }
+ return i
+ }, t.prototype.parseStringBMP = function (t, e) {
+ for (var i, r, n = "", s = t; s < e;) i = this.get(s++), r = this.get(s++), n += String.fromCharCode(i << 8 | r);
+ return n
+ }, t.prototype.parseTime = function (t, e, i) {
+ var r = this.parseStringISO(t, e), n = (i ? y : b).exec(r);
+ return n ? (i && (n[1] = +n[1], n[1] += +n[1] < 70 ? 2e3 : 1900), r = n[1] + "-" + n[2] + "-" + n[3] + " " + n[4], n[5] && (r += ":" + n[5], n[6] && (r += ":" + n[6], n[7] && (r += "." + n[7]))), n[8] && (r += " UTC", "Z" != n[8] && (r += n[8], n[9] && (r += ":" + n[9]))), r) : "Unrecognized time: " + r
+ }, t.prototype.parseInteger = function (t, e) {
+ for (var i, r = this.get(t), n = r > 127, s = n ? 255 : 0, o = ""; r == s && ++t < e;) r = this.get(t);
+ if (0 == (i = e - t)) return n ? -1 : 0;
+ if (i > 4) {
+ for (o = r, i <<= 3; 0 == (128 & (+o ^ s));) o = +o << 1, --i;
+ o = "(" + i + " bit)\n"
+ }
+ n && (r -= 256);
+ for (var h = new m(r), a = t + 1; a < e; ++a) h.mulAdd(256, this.get(a));
+ return o + h.toString()
+ }, t.prototype.parseBitString = function (t, e, i) {
+ for (var r = this.get(t), n = "(" + ((e - t - 1 << 3) - r) + " bit)\n", s = "", o = t + 1; o < e; ++o) {
+ for (var h = this.get(o), a = o == e - 1 ? r : 0, u = 7; u >= a; --u) s += h >> u & 1 ? "1" : "0";
+ if (s.length > i) return n + T(s, i)
+ }
+ return n + s
+ }, t.prototype.parseOctetString = function (t, e, i) {
+ if (this.isASCII(t, e)) return T(this.parseStringISO(t, e), i);
+ var r = e - t, n = "(" + r + " byte)\n";
+ r > (i /= 2) && (e = t + i);
+ for (var s = t; s < e; ++s) n += this.hexByte(this.get(s));
+ return r > i && (n += "…"), n
+ }, t.prototype.parseOID = function (t, e, i) {
+ for (var r = "", n = new m, s = 0, o = t; o < e; ++o) {
+ var h = this.get(o);
+ if (n.mulAdd(128, 127 & h), s += 7, !(128 & h)) {
+ if ("" === r) if ((n = n.simplify()) instanceof m) n.sub(80), r = "2." + n.toString(); else {
+ var a = n < 80 ? n < 40 ? 0 : 1 : 2;
+ r = a + "." + (n - 40 * a)
+ } else r += "." + n.toString();
+ if (r.length > i) return T(r, i);
+ n = new m, s = 0
+ }
+ }
+ return s > 0 && (r += ".incomplete"), r
+ }, t
+ }(), w = function () {
+ function t(t, e, i, r, n) {
+ if (!(r instanceof D)) throw new Error("Invalid tag value.");
+ this.stream = t, this.header = e, this.length = i, this.tag = r, this.sub = n
+ }
+
+ return t.prototype.typeName = function () {
+ switch (this.tag.tagClass) {
+ case 0:
+ switch (this.tag.tagNumber) {
+ case 0:
+ return "EOC";
+ case 1:
+ return "BOOLEAN";
+ case 2:
+ return "INTEGER";
+ case 3:
+ return "BIT_STRING";
+ case 4:
+ return "OCTET_STRING";
+ case 5:
+ return "NULL";
+ case 6:
+ return "OBJECT_IDENTIFIER";
+ case 7:
+ return "ObjectDescriptor";
+ case 8:
+ return "EXTERNAL";
+ case 9:
+ return "REAL";
+ case 10:
+ return "ENUMERATED";
+ case 11:
+ return "EMBEDDED_PDV";
+ case 12:
+ return "UTF8String";
+ case 16:
+ return "SEQUENCE";
+ case 17:
+ return "SET";
+ case 18:
+ return "NumericString";
+ case 19:
+ return "PrintableString";
+ case 20:
+ return "TeletexString";
+ case 21:
+ return "VideotexString";
+ case 22:
+ return "IA5String";
+ case 23:
+ return "UTCTime";
+ case 24:
+ return "GeneralizedTime";
+ case 25:
+ return "GraphicString";
+ case 26:
+ return "VisibleString";
+ case 27:
+ return "GeneralString";
+ case 28:
+ return "UniversalString";
+ case 30:
+ return "BMPString"
+ }
+ return "Universal_" + this.tag.tagNumber.toString();
+ case 1:
+ return "Application_" + this.tag.tagNumber.toString();
+ case 2:
+ return "[" + this.tag.tagNumber.toString() + "]";
+ case 3:
+ return "Private_" + this.tag.tagNumber.toString()
+ }
+ }, t.prototype.content = function (t) {
+ if (void 0 === this.tag) return null;
+ void 0 === t && (t = 1 / 0);
+ var e = this.posContent(), i = Math.abs(this.length);
+ if (!this.tag.isUniversal()) return null !== this.sub ? "(" + this.sub.length + " elem)" : this.stream.parseOctetString(e, e + i, t);
+ switch (this.tag.tagNumber) {
+ case 1:
+ return 0 === this.stream.get(e) ? "false" : "true";
+ case 2:
+ return this.stream.parseInteger(e, e + i);
+ case 3:
+ return this.sub ? "(" + this.sub.length + " elem)" : this.stream.parseBitString(e, e + i, t);
+ case 4:
+ return this.sub ? "(" + this.sub.length + " elem)" : this.stream.parseOctetString(e, e + i, t);
+ case 6:
+ return this.stream.parseOID(e, e + i, t);
+ case 16:
+ case 17:
+ return null !== this.sub ? "(" + this.sub.length + " elem)" : "(no elem)";
+ case 12:
+ return T(this.stream.parseStringUTF(e, e + i), t);
+ case 18:
+ case 19:
+ case 20:
+ case 21:
+ case 22:
+ case 26:
+ return T(this.stream.parseStringISO(e, e + i), t);
+ case 30:
+ return T(this.stream.parseStringBMP(e, e + i), t);
+ case 23:
+ case 24:
+ return this.stream.parseTime(e, e + i, 23 == this.tag.tagNumber)
+ }
+ return null
+ }, t.prototype.toString = function () {
+ return this.typeName() + "@" + this.stream.pos + "[header:" + this.header + ",length:" + this.length + ",sub:" + (null === this.sub ? "null" : this.sub.length) + "]"
+ }, t.prototype.toPrettyString = function (t) {
+ void 0 === t && (t = "");
+ var e = t + this.typeName() + " @" + this.stream.pos;
+ if (this.length >= 0 && (e += "+"), e += this.length, this.tag.tagConstructed ? e += " (constructed)" : !this.tag.isUniversal() || 3 != this.tag.tagNumber && 4 != this.tag.tagNumber || null === this.sub || (e += " (encapsulates)"), e += "\n", null !== this.sub) {
+ t += " ";
+ for (var i = 0, r = this.sub.length; i < r; ++i) e += this.sub[i].toPrettyString(t)
+ }
+ return e
+ }, t.prototype.posStart = function () {
+ return this.stream.pos
+ }, t.prototype.posContent = function () {
+ return this.stream.pos + this.header
+ }, t.prototype.posEnd = function () {
+ return this.stream.pos + this.header + Math.abs(this.length)
+ }, t.prototype.toHexString = function () {
+ return this.stream.hexDump(this.posStart(), this.posEnd(), !0)
+ }, t.decodeLength = function (t) {
+ var e = t.get(), i = 127 & e;
+ if (i == e) return i;
+ if (i > 6) throw new Error("Length over 48 bits not supported at position " + (t.pos - 1));
+ if (0 === i) return null;
+ e = 0;
+ for (var r = 0; r < i; ++r) e = 256 * e + t.get();
+ return e
+ }, t.prototype.getHexStringValue = function () {
+ var t = this.toHexString(), e = 2 * this.header, i = 2 * this.length;
+ return t.substr(e, i)
+ }, t.decode = function (e) {
+ var i;
+ i = e instanceof E ? e : new E(e, 0);
+ var r = new E(i), n = new D(i), s = t.decodeLength(i), o = i.pos, h = o - r.pos, a = null,
+ u = function () {
+ var e = [];
+ if (null !== s) {
+ for (var r = o + s; i.pos < r;) e[e.length] = t.decode(i);
+ if (i.pos != r) throw new Error("Content size is not correct for container starting at offset " + o)
+ } else try {
+ for (; ;) {
+ var n = t.decode(i);
+ if (n.tag.isEOC()) break;
+ e[e.length] = n
+ }
+ s = o - i.pos
+ } catch (t) {
+ throw new Error("Exception while decoding undefined length content: " + t)
+ }
+ return e
+ };
+ if (n.tagConstructed) a = u(); else if (n.isUniversal() && (3 == n.tagNumber || 4 == n.tagNumber)) try {
+ if (3 == n.tagNumber && 0 != i.get()) throw new Error("BIT STRINGs with unused bits cannot encapsulate.");
+ a = u();
+ for (var c = 0; c < a.length; ++c) if (a[c].tag.isEOC()) throw new Error("EOC is not supposed to be actual content.")
+ } catch (t) {
+ a = null
+ }
+ if (null === a) {
+ if (null === s) throw new Error("We can't skip over an invalid tag with undefined length at offset " + o);
+ i.pos = o + Math.abs(s)
+ }
+ return new t(r, h, s, n, a)
+ }, t
+ }(), D = function () {
+ function t(t) {
+ var e = t.get();
+ if (this.tagClass = e >> 6, this.tagConstructed = 0 != (32 & e), this.tagNumber = 31 & e, 31 == this.tagNumber) {
+ var i = new m;
+ do {
+ e = t.get(), i.mulAdd(128, 127 & e)
+ } while (128 & e);
+ this.tagNumber = i.simplify()
+ }
+ }
+
+ return t.prototype.isUniversal = function () {
+ return 0 === this.tagClass
+ }, t.prototype.isEOC = function () {
+ return 0 === this.tagClass && 0 === this.tagNumber
+ }, t
+ }(),
+ x = [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59, 61, 67, 71, 73, 79, 83, 89, 97, 101, 103, 107, 109, 113, 127, 131, 137, 139, 149, 151, 157, 163, 167, 173, 179, 181, 191, 193, 197, 199, 211, 223, 227, 229, 233, 239, 241, 251, 257, 263, 269, 271, 277, 281, 283, 293, 307, 311, 313, 317, 331, 337, 347, 349, 353, 359, 367, 373, 379, 383, 389, 397, 401, 409, 419, 421, 431, 433, 439, 443, 449, 457, 461, 463, 467, 479, 487, 491, 499, 503, 509, 521, 523, 541, 547, 557, 563, 569, 571, 577, 587, 593, 599, 601, 607, 613, 617, 619, 631, 641, 643, 647, 653, 659, 661, 673, 677, 683, 691, 701, 709, 719, 727, 733, 739, 743, 751, 757, 761, 769, 773, 787, 797, 809, 811, 821, 823, 827, 829, 839, 853, 857, 859, 863, 877, 881, 883, 887, 907, 911, 919, 929, 937, 941, 947, 953, 967, 971, 977, 983, 991, 997],
+ R = (1 << 26) / x[x.length - 1], B = function () {
+ function t(t, e, i) {
+ null != t && ("number" == typeof t ? this.fromNumber(t, e, i) : null == e && "string" != typeof t ? this.fromString(t, 256) : this.fromString(t, e))
+ }
+
+ return t.prototype.toString = function (t) {
+ if (this.s < 0) return "-" + this.negate().toString(t);
+ var e;
+ if (16 == t) e = 4; else if (8 == t) e = 3; else if (2 == t) e = 1; else if (32 == t) e = 5; else {
+ if (4 != t) return this.toRadix(t);
+ e = 2
+ }
+ var i, n = (1 << e) - 1, s = !1, o = "", h = this.t, a = this.DB - h * this.DB % e;
+ if (h-- > 0) for (a < this.DB && (i = this[h] >> a) > 0 && (s = !0, o = r(i)); h >= 0;) a < e ? (i = (this[h] & (1 << a) - 1) << e - a, i |= this[--h] >> (a += this.DB - e)) : (i = this[h] >> (a -= e) & n, a <= 0 && (a += this.DB, --h)), i > 0 && (s = !0), s && (o += r(i));
+ return s ? o : "0"
+ }, t.prototype.negate = function () {
+ var e = N();
+ return t.ZERO.subTo(this, e), e
+ }, t.prototype.abs = function () {
+ return this.s < 0 ? this.negate() : this
+ }, t.prototype.compareTo = function (t) {
+ var e = this.s - t.s;
+ if (0 != e) return e;
+ var i = this.t;
+ if (0 != (e = i - t.t)) return this.s < 0 ? -e : e;
+ for (; --i >= 0;) if (0 != (e = this[i] - t[i])) return e;
+ return 0
+ }, t.prototype.bitLength = function () {
+ return this.t <= 0 ? 0 : this.DB * (this.t - 1) + F(this[this.t - 1] ^ this.s & this.DM)
+ }, t.prototype.mod = function (e) {
+ var i = N();
+ return this.abs().divRemTo(e, null, i), this.s < 0 && i.compareTo(t.ZERO) > 0 && e.subTo(i, i), i
+ }, t.prototype.modPowInt = function (t, e) {
+ var i;
+ return i = t < 256 || e.isEven() ? new A(e) : new V(e), this.exp(t, i)
+ }, t.prototype.clone = function () {
+ var t = N();
+ return this.copyTo(t), t
+ }, t.prototype.intValue = function () {
+ if (this.s < 0) {
+ if (1 == this.t) return this[0] - this.DV;
+ if (0 == this.t) return -1
+ } else {
+ if (1 == this.t) return this[0];
+ if (0 == this.t) return 0
+ }
+ return (this[1] & (1 << 32 - this.DB) - 1) << this.DB | this[0]
+ }, t.prototype.byteValue = function () {
+ return 0 == this.t ? this.s : this[0] << 24 >> 24
+ }, t.prototype.shortValue = function () {
+ return 0 == this.t ? this.s : this[0] << 16 >> 16
+ }, t.prototype.signum = function () {
+ return this.s < 0 ? -1 : this.t <= 0 || 1 == this.t && this[0] <= 0 ? 0 : 1
+ }, t.prototype.toByteArray = function () {
+ var t = this.t, e = [];
+ e[0] = this.s;
+ var i, r = this.DB - t * this.DB % 8, n = 0;
+ if (t-- > 0) for (r < this.DB && (i = this[t] >> r) != (this.s & this.DM) >> r && (e[n++] = i | this.s << this.DB - r); t >= 0;) r < 8 ? (i = (this[t] & (1 << r) - 1) << 8 - r, i |= this[--t] >> (r += this.DB - 8)) : (i = this[t] >> (r -= 8) & 255, r <= 0 && (r += this.DB, --t)), 0 != (128 & i) && (i |= -256), 0 == n && (128 & this.s) != (128 & i) && ++n, (n > 0 || i != this.s) && (e[n++] = i);
+ return e
+ }, t.prototype.equals = function (t) {
+ return 0 == this.compareTo(t)
+ }, t.prototype.min = function (t) {
+ return this.compareTo(t) < 0 ? this : t
+ }, t.prototype.max = function (t) {
+ return this.compareTo(t) > 0 ? this : t
+ }, t.prototype.and = function (t) {
+ var e = N();
+ return this.bitwiseTo(t, n, e), e
+ }, t.prototype.or = function (t) {
+ var e = N();
+ return this.bitwiseTo(t, s, e), e
+ }, t.prototype.xor = function (t) {
+ var e = N();
+ return this.bitwiseTo(t, o, e), e
+ }, t.prototype.andNot = function (t) {
+ var e = N();
+ return this.bitwiseTo(t, h, e), e
+ }, t.prototype.not = function () {
+ for (var t = N(), e = 0; e < this.t; ++e) t[e] = this.DM & ~this[e];
+ return t.t = this.t, t.s = ~this.s, t
+ }, t.prototype.shiftLeft = function (t) {
+ var e = N();
+ return t < 0 ? this.rShiftTo(-t, e) : this.lShiftTo(t, e), e
+ }, t.prototype.shiftRight = function (t) {
+ var e = N();
+ return t < 0 ? this.lShiftTo(-t, e) : this.rShiftTo(t, e), e
+ }, t.prototype.getLowestSetBit = function () {
+ for (var t = 0; t < this.t; ++t) if (0 != this[t]) return t * this.DB + a(this[t]);
+ return this.s < 0 ? this.t * this.DB : -1
+ }, t.prototype.bitCount = function () {
+ for (var t = 0, e = this.s & this.DM, i = 0; i < this.t; ++i) t += u(this[i] ^ e);
+ return t
+ }, t.prototype.testBit = function (t) {
+ var e = Math.floor(t / this.DB);
+ return e >= this.t ? 0 != this.s : 0 != (this[e] & 1 << t % this.DB)
+ }, t.prototype.setBit = function (t) {
+ return this.changeBit(t, s)
+ }, t.prototype.clearBit = function (t) {
+ return this.changeBit(t, h)
+ }, t.prototype.flipBit = function (t) {
+ return this.changeBit(t, o)
+ }, t.prototype.add = function (t) {
+ var e = N();
+ return this.addTo(t, e), e
+ }, t.prototype.subtract = function (t) {
+ var e = N();
+ return this.subTo(t, e), e
+ }, t.prototype.multiply = function (t) {
+ var e = N();
+ return this.multiplyTo(t, e), e
+ }, t.prototype.divide = function (t) {
+ var e = N();
+ return this.divRemTo(t, e, null), e
+ }, t.prototype.remainder = function (t) {
+ var e = N();
+ return this.divRemTo(t, null, e), e
+ }, t.prototype.divideAndRemainder = function (t) {
+ var e = N(), i = N();
+ return this.divRemTo(t, e, i), [e, i]
+ }, t.prototype.modPow = function (t, e) {
+ var i, r, n = t.bitLength(), s = C(1);
+ if (n <= 0) return s;
+ i = n < 18 ? 1 : n < 48 ? 3 : n < 144 ? 4 : n < 768 ? 5 : 6, r = n < 8 ? new A(e) : e.isEven() ? new I(e) : new V(e);
+ var o = [], h = 3, a = i - 1, u = (1 << i) - 1;
+ if (o[1] = r.convert(this), i > 1) {
+ var c = N();
+ for (r.sqrTo(o[1], c); h <= u;) o[h] = N(), r.mulTo(c, o[h - 2], o[h]), h += 2
+ }
+ var f, l, p = t.t - 1, g = !0, d = N();
+ for (n = F(t[p]) - 1; p >= 0;) {
+ for (n >= a ? f = t[p] >> n - a & u : (f = (t[p] & (1 << n + 1) - 1) << a - n, p > 0 && (f |= t[p - 1] >> this.DB + n - a)), h = i; 0 == (1 & f);) f >>= 1, --h;
+ if ((n -= h) < 0 && (n += this.DB, --p), g) o[f].copyTo(s), g = !1; else {
+ for (; h > 1;) r.sqrTo(s, d), r.sqrTo(d, s), h -= 2;
+ h > 0 ? r.sqrTo(s, d) : (l = s, s = d, d = l), r.mulTo(d, o[f], s)
+ }
+ for (; p >= 0 && 0 == (t[p] & 1 << n);) r.sqrTo(s, d), l = s, s = d, d = l, --n < 0 && (n = this.DB - 1, --p)
+ }
+ return r.revert(s)
+ }, t.prototype.modInverse = function (e) {
+ var i = e.isEven();
+ if (this.isEven() && i || 0 == e.signum()) return t.ZERO;
+ for (var r = e.clone(), n = this.clone(), s = C(1), o = C(0), h = C(0), a = C(1); 0 != r.signum();) {
+ for (; r.isEven();) r.rShiftTo(1, r), i ? (s.isEven() && o.isEven() || (s.addTo(this, s), o.subTo(e, o)), s.rShiftTo(1, s)) : o.isEven() || o.subTo(e, o), o.rShiftTo(1, o);
+ for (; n.isEven();) n.rShiftTo(1, n), i ? (h.isEven() && a.isEven() || (h.addTo(this, h), a.subTo(e, a)), h.rShiftTo(1, h)) : a.isEven() || a.subTo(e, a), a.rShiftTo(1, a);
+ r.compareTo(n) >= 0 ? (r.subTo(n, r), i && s.subTo(h, s), o.subTo(a, o)) : (n.subTo(r, n), i && h.subTo(s, h), a.subTo(o, a))
+ }
+ return 0 != n.compareTo(t.ONE) ? t.ZERO : a.compareTo(e) >= 0 ? a.subtract(e) : a.signum() < 0 ? (a.addTo(e, a), a.signum() < 0 ? a.add(e) : a) : a
+ }, t.prototype.pow = function (t) {
+ return this.exp(t, new O)
+ }, t.prototype.gcd = function (t) {
+ var e = this.s < 0 ? this.negate() : this.clone(), i = t.s < 0 ? t.negate() : t.clone();
+ if (e.compareTo(i) < 0) {
+ var r = e;
+ e = i, i = r
+ }
+ var n = e.getLowestSetBit(), s = i.getLowestSetBit();
+ if (s < 0) return e;
+ for (n < s && (s = n), s > 0 && (e.rShiftTo(s, e), i.rShiftTo(s, i)); e.signum() > 0;) (n = e.getLowestSetBit()) > 0 && e.rShiftTo(n, e), (n = i.getLowestSetBit()) > 0 && i.rShiftTo(n, i), e.compareTo(i) >= 0 ? (e.subTo(i, e), e.rShiftTo(1, e)) : (i.subTo(e, i), i.rShiftTo(1, i));
+ return s > 0 && i.lShiftTo(s, i), i
+ }, t.prototype.isProbablePrime = function (t) {
+ var e, i = this.abs();
+ if (1 == i.t && i[0] <= x[x.length - 1]) {
+ for (e = 0; e < x.length; ++e) if (i[0] == x[e]) return !0;
+ return !1
+ }
+ if (i.isEven()) return !1;
+ for (e = 1; e < x.length;) {
+ for (var r = x[e], n = e + 1; n < x.length && r < R;) r *= x[n++];
+ for (r = i.modInt(r); e < n;) if (r % x[e++] == 0) return !1
+ }
+ return i.millerRabin(t)
+ }, t.prototype.copyTo = function (t) {
+ for (var e = this.t - 1; e >= 0; --e) t[e] = this[e];
+ t.t = this.t, t.s = this.s
+ }, t.prototype.fromInt = function (t) {
+ this.t = 1, this.s = t < 0 ? -1 : 0, t > 0 ? this[0] = t : t < -1 ? this[0] = t + this.DV : this.t = 0
+ }, t.prototype.fromString = function (e, i) {
+ var r;
+ if (16 == i) r = 4; else if (8 == i) r = 3; else if (256 == i) r = 8; else if (2 == i) r = 1; else if (32 == i) r = 5; else {
+ if (4 != i) return void this.fromRadix(e, i);
+ r = 2
+ }
+ this.t = 0, this.s = 0;
+ for (var n = e.length, s = !1, o = 0; --n >= 0;) {
+ var h = 8 == r ? 255 & +e[n] : H(e, n);
+ h < 0 ? "-" == e.charAt(n) && (s = !0) : (s = !1, 0 == o ? this[this.t++] = h : o + r > this.DB ? (this[this.t - 1] |= (h & (1 << this.DB - o) - 1) << o, this[this.t++] = h >> this.DB - o) : this[this.t - 1] |= h << o, (o += r) >= this.DB && (o -= this.DB))
+ }
+ 8 == r && 0 != (128 & +e[0]) && (this.s = -1, o > 0 && (this[this.t - 1] |= (1 << this.DB - o) - 1 << o)), this.clamp(), s && t.ZERO.subTo(this, this)
+ }, t.prototype.clamp = function () {
+ for (var t = this.s & this.DM; this.t > 0 && this[this.t - 1] == t;) --this.t
+ }, t.prototype.dlShiftTo = function (t, e) {
+ var i;
+ for (i = this.t - 1; i >= 0; --i) e[i + t] = this[i];
+ for (i = t - 1; i >= 0; --i) e[i] = 0;
+ e.t = this.t + t, e.s = this.s
+ }, t.prototype.drShiftTo = function (t, e) {
+ for (var i = t; i < this.t; ++i) e[i - t] = this[i];
+ e.t = Math.max(this.t - t, 0), e.s = this.s
+ }, t.prototype.lShiftTo = function (t, e) {
+ for (var i = t % this.DB, r = this.DB - i, n = (1 << r) - 1, s = Math.floor(t / this.DB), o = this.s << i & this.DM, h = this.t - 1; h >= 0; --h) e[h + s + 1] = this[h] >> r | o, o = (this[h] & n) << i;
+ for (h = s - 1; h >= 0; --h) e[h] = 0;
+ e[s] = o, e.t = this.t + s + 1, e.s = this.s, e.clamp()
+ }, t.prototype.rShiftTo = function (t, e) {
+ e.s = this.s;
+ var i = Math.floor(t / this.DB);
+ if (i >= this.t) e.t = 0; else {
+ var r = t % this.DB, n = this.DB - r, s = (1 << r) - 1;
+ e[0] = this[i] >> r;
+ for (var o = i + 1; o < this.t; ++o) e[o - i - 1] |= (this[o] & s) << n, e[o - i] = this[o] >> r;
+ r > 0 && (e[this.t - i - 1] |= (this.s & s) << n), e.t = this.t - i, e.clamp()
+ }
+ }, t.prototype.subTo = function (t, e) {
+ for (var i = 0, r = 0, n = Math.min(t.t, this.t); i < n;) r += this[i] - t[i], e[i++] = r & this.DM, r >>= this.DB;
+ if (t.t < this.t) {
+ for (r -= t.s; i < this.t;) r += this[i], e[i++] = r & this.DM, r >>= this.DB;
+ r += this.s
+ } else {
+ for (r += this.s; i < t.t;) r -= t[i], e[i++] = r & this.DM, r >>= this.DB;
+ r -= t.s
+ }
+ e.s = r < 0 ? -1 : 0, r < -1 ? e[i++] = this.DV + r : r > 0 && (e[i++] = r), e.t = i, e.clamp()
+ }, t.prototype.multiplyTo = function (e, i) {
+ var r = this.abs(), n = e.abs(), s = r.t;
+ for (i.t = s + n.t; --s >= 0;) i[s] = 0;
+ for (s = 0; s < n.t; ++s) i[s + r.t] = r.am(0, n[s], i, s, 0, r.t);
+ i.s = 0, i.clamp(), this.s != e.s && t.ZERO.subTo(i, i)
+ }, t.prototype.squareTo = function (t) {
+ for (var e = this.abs(), i = t.t = 2 * e.t; --i >= 0;) t[i] = 0;
+ for (i = 0; i < e.t - 1; ++i) {
+ var r = e.am(i, e[i], t, 2 * i, 0, 1);
+ (t[i + e.t] += e.am(i + 1, 2 * e[i], t, 2 * i + 1, r, e.t - i - 1)) >= e.DV && (t[i + e.t] -= e.DV, t[i + e.t + 1] = 1)
+ }
+ t.t > 0 && (t[t.t - 1] += e.am(i, e[i], t, 2 * i, 0, 1)), t.s = 0, t.clamp()
+ }, t.prototype.divRemTo = function (e, i, r) {
+ var n = e.abs();
+ if (!(n.t <= 0)) {
+ var s = this.abs();
+ if (s.t < n.t) return null != i && i.fromInt(0), void (null != r && this.copyTo(r));
+ null == r && (r = N());
+ var o = N(), h = this.s, a = e.s, u = this.DB - F(n[n.t - 1]);
+ u > 0 ? (n.lShiftTo(u, o), s.lShiftTo(u, r)) : (n.copyTo(o), s.copyTo(r));
+ var c = o.t, f = o[c - 1];
+ if (0 != f) {
+ var l = f * (1 << this.F1) + (c > 1 ? o[c - 2] >> this.F2 : 0), p = this.FV / l,
+ g = (1 << this.F1) / l, d = 1 << this.F2, v = r.t, m = v - c,
+ y = null == i ? N() : i;
+ for (o.dlShiftTo(m, y), r.compareTo(y) >= 0 && (r[r.t++] = 1, r.subTo(y, r)), t.ONE.dlShiftTo(c, y), y.subTo(o, o); o.t < c;) o[o.t++] = 0;
+ for (; --m >= 0;) {
+ var b = r[--v] == f ? this.DM : Math.floor(r[v] * p + (r[v - 1] + d) * g);
+ if ((r[v] += o.am(0, b, r, m, 0, c)) < b) for (o.dlShiftTo(m, y), r.subTo(y, r); r[v] < --b;) r.subTo(y, r)
+ }
+ null != i && (r.drShiftTo(c, i), h != a && t.ZERO.subTo(i, i)), r.t = c, r.clamp(), u > 0 && r.rShiftTo(u, r), h < 0 && t.ZERO.subTo(r, r)
+ }
+ }
+ }, t.prototype.invDigit = function () {
+ if (this.t < 1) return 0;
+ var t = this[0];
+ if (0 == (1 & t)) return 0;
+ var e = 3 & t;
+ return (e = (e = (e = (e = e * (2 - (15 & t) * e) & 15) * (2 - (255 & t) * e) & 255) * (2 - ((65535 & t) * e & 65535)) & 65535) * (2 - t * e % this.DV) % this.DV) > 0 ? this.DV - e : -e
+ }, t.prototype.isEven = function () {
+ return 0 == (this.t > 0 ? 1 & this[0] : this.s)
+ }, t.prototype.exp = function (e, i) {
+ if (e > 4294967295 || e < 1) return t.ONE;
+ var r = N(), n = N(), s = i.convert(this), o = F(e) - 1;
+ for (s.copyTo(r); --o >= 0;) if (i.sqrTo(r, n), (e & 1 << o) > 0) i.mulTo(n, s, r); else {
+ var h = r;
+ r = n, n = h
+ }
+ return i.revert(r)
+ }, t.prototype.chunkSize = function (t) {
+ return Math.floor(Math.LN2 * this.DB / Math.log(t))
+ }, t.prototype.toRadix = function (t) {
+ if (null == t && (t = 10), 0 == this.signum() || t < 2 || t > 36) return "0";
+ var e = this.chunkSize(t), i = Math.pow(t, e), r = C(i), n = N(), s = N(), o = "";
+ for (this.divRemTo(r, n, s); n.signum() > 0;) o = (i + s.intValue()).toString(t).substr(1) + o, n.divRemTo(r, n, s);
+ return s.intValue().toString(t) + o
+ }, t.prototype.fromRadix = function (e, i) {
+ this.fromInt(0), null == i && (i = 10);
+ for (var r = this.chunkSize(i), n = Math.pow(i, r), s = !1, o = 0, h = 0, a = 0; a < e.length; ++a) {
+ var u = H(e, a);
+ u < 0 ? "-" == e.charAt(a) && 0 == this.signum() && (s = !0) : (h = i * h + u, ++o >= r && (this.dMultiply(n), this.dAddOffset(h, 0), o = 0, h = 0))
+ }
+ o > 0 && (this.dMultiply(Math.pow(i, o)), this.dAddOffset(h, 0)), s && t.ZERO.subTo(this, this)
+ }, t.prototype.fromNumber = function (e, i, r) {
+ if ("number" == typeof i) if (e < 2) this.fromInt(1); else for (this.fromNumber(e, r), this.testBit(e - 1) || this.bitwiseTo(t.ONE.shiftLeft(e - 1), s, this), this.isEven() && this.dAddOffset(1, 0); !this.isProbablePrime(i);) this.dAddOffset(2, 0), this.bitLength() > e && this.subTo(t.ONE.shiftLeft(e - 1), this); else {
+ var n = [], o = 7 & e;
+ n.length = 1 + (e >> 3), i.nextBytes(n), o > 0 ? n[0] &= (1 << o) - 1 : n[0] = 0, this.fromString(n, 256)
+ }
+ }, t.prototype.bitwiseTo = function (t, e, i) {
+ var r, n, s = Math.min(t.t, this.t);
+ for (r = 0; r < s; ++r) i[r] = e(this[r], t[r]);
+ if (t.t < this.t) {
+ for (n = t.s & this.DM, r = s; r < this.t; ++r) i[r] = e(this[r], n);
+ i.t = this.t
+ } else {
+ for (n = this.s & this.DM, r = s; r < t.t; ++r) i[r] = e(n, t[r]);
+ i.t = t.t
+ }
+ i.s = e(this.s, t.s), i.clamp()
+ }, t.prototype.changeBit = function (e, i) {
+ var r = t.ONE.shiftLeft(e);
+ return this.bitwiseTo(r, i, r), r
+ }, t.prototype.addTo = function (t, e) {
+ for (var i = 0, r = 0, n = Math.min(t.t, this.t); i < n;) r += this[i] + t[i], e[i++] = r & this.DM, r >>= this.DB;
+ if (t.t < this.t) {
+ for (r += t.s; i < this.t;) r += this[i], e[i++] = r & this.DM, r >>= this.DB;
+ r += this.s
+ } else {
+ for (r += this.s; i < t.t;) r += t[i], e[i++] = r & this.DM, r >>= this.DB;
+ r += t.s
+ }
+ e.s = r < 0 ? -1 : 0, r > 0 ? e[i++] = r : r < -1 && (e[i++] = this.DV + r), e.t = i, e.clamp()
+ }, t.prototype.dMultiply = function (t) {
+ this[this.t] = this.am(0, t - 1, this, 0, 0, this.t), ++this.t, this.clamp()
+ }, t.prototype.dAddOffset = function (t, e) {
+ if (0 != t) {
+ for (; this.t <= e;) this[this.t++] = 0;
+ for (this[e] += t; this[e] >= this.DV;) this[e] -= this.DV, ++e >= this.t && (this[this.t++] = 0), ++this[e]
+ }
+ }, t.prototype.multiplyLowerTo = function (t, e, i) {
+ var r = Math.min(this.t + t.t, e);
+ for (i.s = 0, i.t = r; r > 0;) i[--r] = 0;
+ for (var n = i.t - this.t; r < n; ++r) i[r + this.t] = this.am(0, t[r], i, r, 0, this.t);
+ for (n = Math.min(t.t, e); r < n; ++r) this.am(0, t[r], i, r, 0, e - r);
+ i.clamp()
+ }, t.prototype.multiplyUpperTo = function (t, e, i) {
+ --e;
+ var r = i.t = this.t + t.t - e;
+ for (i.s = 0; --r >= 0;) i[r] = 0;
+ for (r = Math.max(e - this.t, 0); r < t.t; ++r) i[this.t + r - e] = this.am(e - r, t[r], i, 0, 0, this.t + r - e);
+ i.clamp(), i.drShiftTo(1, i)
+ }, t.prototype.modInt = function (t) {
+ if (t <= 0) return 0;
+ var e = this.DV % t, i = this.s < 0 ? t - 1 : 0;
+ if (this.t > 0) if (0 == e) i = this[0] % t; else for (var r = this.t - 1; r >= 0; --r) i = (e * i + this[r]) % t;
+ return i
+ }, t.prototype.millerRabin = function (e) {
+ var i = this.subtract(t.ONE), r = i.getLowestSetBit();
+ if (r <= 0) return !1;
+ var n = i.shiftRight(r);
+ (e = e + 1 >> 1) > x.length && (e = x.length);
+ for (var s = N(), o = 0; o < e; ++o) {
+ s.fromInt(x[Math.floor(Math.random() * x.length)]);
+ var h = s.modPow(n, this);
+ if (0 != h.compareTo(t.ONE) && 0 != h.compareTo(i)) {
+ for (var a = 1; a++ < r && 0 != h.compareTo(i);) if (0 == (h = h.modPowInt(2, this)).compareTo(t.ONE)) return !1;
+ if (0 != h.compareTo(i)) return !1
+ }
+ }
+ return !0
+ }, t.prototype.square = function () {
+ var t = N();
+ return this.squareTo(t), t
+ }, t.prototype.gcda = function (t, e) {
+ var i = this.s < 0 ? this.negate() : this.clone(), r = t.s < 0 ? t.negate() : t.clone();
+ if (i.compareTo(r) < 0) {
+ var n = i;
+ i = r, r = n
+ }
+ var s = i.getLowestSetBit(), o = r.getLowestSetBit();
+ if (o < 0) e(i); else {
+ s < o && (o = s), o > 0 && (i.rShiftTo(o, i), r.rShiftTo(o, r));
+ var h = function () {
+ (s = i.getLowestSetBit()) > 0 && i.rShiftTo(s, i), (s = r.getLowestSetBit()) > 0 && r.rShiftTo(s, r), i.compareTo(r) >= 0 ? (i.subTo(r, i), i.rShiftTo(1, i)) : (r.subTo(i, r), r.rShiftTo(1, r)), i.signum() > 0 ? setTimeout(h, 0) : (o > 0 && r.lShiftTo(o, r), setTimeout((function () {
+ e(r)
+ }), 0))
+ };
+ setTimeout(h, 10)
+ }
+ }, t.prototype.fromNumberAsync = function (e, i, r, n) {
+ if ("number" == typeof i) if (e < 2) this.fromInt(1); else {
+ this.fromNumber(e, r), this.testBit(e - 1) || this.bitwiseTo(t.ONE.shiftLeft(e - 1), s, this), this.isEven() && this.dAddOffset(1, 0);
+ var o = this, h = function () {
+ o.dAddOffset(2, 0), o.bitLength() > e && o.subTo(t.ONE.shiftLeft(e - 1), o), o.isProbablePrime(i) ? setTimeout((function () {
+ n()
+ }), 0) : setTimeout(h, 0)
+ };
+ setTimeout(h, 0)
+ } else {
+ var a = [], u = 7 & e;
+ a.length = 1 + (e >> 3), i.nextBytes(a), u > 0 ? a[0] &= (1 << u) - 1 : a[0] = 0, this.fromString(a, 256)
+ }
+ }, t
+ }(), O = function () {
+ function t() {
+ }
+
+ return t.prototype.convert = function (t) {
+ return t
+ }, t.prototype.revert = function (t) {
+ return t
+ }, t.prototype.mulTo = function (t, e, i) {
+ t.multiplyTo(e, i)
+ }, t.prototype.sqrTo = function (t, e) {
+ t.squareTo(e)
+ }, t
+ }(), A = function () {
+ function t(t) {
+ this.m = t
+ }
+
+ return t.prototype.convert = function (t) {
+ return t.s < 0 || t.compareTo(this.m) >= 0 ? t.mod(this.m) : t
+ }, t.prototype.revert = function (t) {
+ return t
+ }, t.prototype.reduce = function (t) {
+ t.divRemTo(this.m, null, t)
+ }, t.prototype.mulTo = function (t, e, i) {
+ t.multiplyTo(e, i), this.reduce(i)
+ }, t.prototype.sqrTo = function (t, e) {
+ t.squareTo(e), this.reduce(e)
+ }, t
+ }(), V = function () {
+ function t(t) {
+ this.m = t, this.mp = t.invDigit(), this.mpl = 32767 & this.mp, this.mph = this.mp >> 15, this.um = (1 << t.DB - 15) - 1, this.mt2 = 2 * t.t
+ }
+
+ return t.prototype.convert = function (t) {
+ var e = N();
+ return t.abs().dlShiftTo(this.m.t, e), e.divRemTo(this.m, null, e), t.s < 0 && e.compareTo(B.ZERO) > 0 && this.m.subTo(e, e), e
+ }, t.prototype.revert = function (t) {
+ var e = N();
+ return t.copyTo(e), this.reduce(e), e
+ }, t.prototype.reduce = function (t) {
+ for (; t.t <= this.mt2;) t[t.t++] = 0;
+ for (var e = 0; e < this.m.t; ++e) {
+ var i = 32767 & t[e],
+ r = i * this.mpl + ((i * this.mph + (t[e] >> 15) * this.mpl & this.um) << 15) & t.DM;
+ for (t[i = e + this.m.t] += this.m.am(0, r, t, e, 0, this.m.t); t[i] >= t.DV;) t[i] -= t.DV, t[++i]++
+ }
+ t.clamp(), t.drShiftTo(this.m.t, t), t.compareTo(this.m) >= 0 && t.subTo(this.m, t)
+ }, t.prototype.mulTo = function (t, e, i) {
+ t.multiplyTo(e, i), this.reduce(i)
+ }, t.prototype.sqrTo = function (t, e) {
+ t.squareTo(e), this.reduce(e)
+ }, t
+ }(), I = function () {
+ function t(t) {
+ this.m = t, this.r2 = N(), this.q3 = N(), B.ONE.dlShiftTo(2 * t.t, this.r2), this.mu = this.r2.divide(t)
+ }
+
+ return t.prototype.convert = function (t) {
+ if (t.s < 0 || t.t > 2 * this.m.t) return t.mod(this.m);
+ if (t.compareTo(this.m) < 0) return t;
+ var e = N();
+ return t.copyTo(e), this.reduce(e), e
+ }, t.prototype.revert = function (t) {
+ return t
+ }, t.prototype.reduce = function (t) {
+ for (t.drShiftTo(this.m.t - 1, this.r2), t.t > this.m.t + 1 && (t.t = this.m.t + 1, t.clamp()), this.mu.multiplyUpperTo(this.r2, this.m.t + 1, this.q3), this.m.multiplyLowerTo(this.q3, this.m.t + 1, this.r2); t.compareTo(this.r2) < 0;) t.dAddOffset(1, this.m.t + 1);
+ for (t.subTo(this.r2, t); t.compareTo(this.m) >= 0;) t.subTo(this.m, t)
+ }, t.prototype.mulTo = function (t, e, i) {
+ t.multiplyTo(e, i), this.reduce(i)
+ }, t.prototype.sqrTo = function (t, e) {
+ t.squareTo(e), this.reduce(e)
+ }, t
+ }();
+
+ function N() {
+ return new B(null)
+ }
+
+ function P(t, e) {
+ return new B(t, e)
+ }
+
+ var M = "undefined" != typeof navigator;
+ M && "Microsoft Internet Explorer" == navigator.appName ? (B.prototype.am = function (t, e, i, r, n, s) {
+ for (var o = 32767 & e, h = e >> 15; --s >= 0;) {
+ var a = 32767 & this[t], u = this[t++] >> 15, c = h * a + u * o;
+ n = ((a = o * a + ((32767 & c) << 15) + i[r] + (1073741823 & n)) >>> 30) + (c >>> 15) + h * u + (n >>> 30), i[r++] = 1073741823 & a
+ }
+ return n
+ }, S = 30) : M && "Netscape" != navigator.appName ? (B.prototype.am = function (t, e, i, r, n, s) {
+ for (; --s >= 0;) {
+ var o = e * this[t++] + i[r] + n;
+ n = Math.floor(o / 67108864), i[r++] = 67108863 & o
+ }
+ return n
+ }, S = 26) : (B.prototype.am = function (t, e, i, r, n, s) {
+ for (var o = 16383 & e, h = e >> 14; --s >= 0;) {
+ var a = 16383 & this[t], u = this[t++] >> 14, c = h * a + u * o;
+ n = ((a = o * a + ((16383 & c) << 14) + i[r] + n) >> 28) + (c >> 14) + h * u, i[r++] = 268435455 & a
+ }
+ return n
+ }, S = 28), B.prototype.DB = S, B.prototype.DM = (1 << S) - 1, B.prototype.DV = 1 << S, B.prototype.FV = Math.pow(2, 52), B.prototype.F1 = 52 - S, B.prototype.F2 = 2 * S - 52;
+ var j, q, L = [];
+ for (j = "0".charCodeAt(0), q = 0; q <= 9; ++q) L[j++] = q;
+ for (j = "a".charCodeAt(0), q = 10; q < 36; ++q) L[j++] = q;
+ for (j = "A".charCodeAt(0), q = 10; q < 36; ++q) L[j++] = q;
+
+ function H(t, e) {
+ var i = L[t.charCodeAt(e)];
+ return null == i ? -1 : i
+ }
+
+ function C(t) {
+ var e = N();
+ return e.fromInt(t), e
+ }
+
+ function F(t) {
+ var e, i = 1;
+ return 0 != (e = t >>> 16) && (t = e, i += 16), 0 != (e = t >> 8) && (t = e, i += 8), 0 != (e = t >> 4) && (t = e, i += 4), 0 != (e = t >> 2) && (t = e, i += 2), 0 != (e = t >> 1) && (t = e, i += 1), i
+ }
+
+ B.ZERO = C(0), B.ONE = C(1);
+ var U, K, k = function () {
+ function t() {
+ this.i = 0, this.j = 0, this.S = []
+ }
+
+ return t.prototype.init = function (t) {
+ var e, i, r;
+ for (e = 0; e < 256; ++e) this.S[e] = e;
+ for (i = 0, e = 0; e < 256; ++e) i = i + this.S[e] + t[e % t.length] & 255, r = this.S[e], this.S[e] = this.S[i], this.S[i] = r;
+ this.i = 0, this.j = 0
+ }, t.prototype.next = function () {
+ var t;
+ return this.i = this.i + 1 & 255, this.j = this.j + this.S[this.i] & 255, t = this.S[this.i], this.S[this.i] = this.S[this.j], this.S[this.j] = t, this.S[t + this.S[this.i] & 255]
+ }, t
+ }(), _ = null;
+ if (null == _) {
+ _ = [], K = 0;
+ var z = void 0;
+ if (window.crypto && window.crypto.getRandomValues) {
+ var Z = new Uint32Array(256);
+ for (window.crypto.getRandomValues(Z), z = 0; z < Z.length; ++z) _[K++] = 255 & Z[z]
+ }
+ var G = 0, $ = function (t) {
+ if ((G = G || 0) >= 256 || K >= 256) window.removeEventListener ? window.removeEventListener("mousemove", $, !1) : window.detachEvent && window.detachEvent("onmousemove", $); else try {
+ var e = t.x + t.y;
+ _[K++] = 255 & e, G += 1
+ } catch (t) {
+ }
+ };
+ window.addEventListener ? window.addEventListener("mousemove", $, !1) : window.attachEvent && window.attachEvent("onmousemove", $)
+ }
+
+ function Y() {
+ if (null == U) {
+ for (U = new k; K < 256;) {
+ var t = Math.floor(65536 * Math.random());
+ _[K++] = 255 & t
+ }
+ for (U.init(_), K = 0; K < _.length; ++K) _[K] = 0;
+ K = 0
+ }
+ return U.next()
+ }
+
+ var J = function () {
+ function t() {
+ }
+
+ return t.prototype.nextBytes = function (t) {
+ for (var e = 0; e < t.length; ++e) t[e] = Y()
+ }, t
+ }(), X = function () {
+ function t() {
+ this.n = null, this.e = 0, this.d = null, this.p = null, this.q = null, this.dmp1 = null, this.dmq1 = null, this.coeff = null
+ }
+
+ return t.prototype.doPublic = function (t) {
+ return t.modPowInt(this.e, this.n)
+ }, t.prototype.doPrivate = function (t) {
+ if (null == this.p || null == this.q) return t.modPow(this.d, this.n);
+ for (var e = t.mod(this.p).modPow(this.dmp1, this.p), i = t.mod(this.q).modPow(this.dmq1, this.q); e.compareTo(i) < 0;) e = e.add(this.p);
+ return e.subtract(i).multiply(this.coeff).mod(this.p).multiply(this.q).add(i)
+ }, t.prototype.setPublic = function (t, e) {
+ null != t && null != e && t.length > 0 && e.length > 0 ? (this.n = P(t, 16), this.e = parseInt(e, 16)) : console.error("Invalid RSA public key")
+ }, t.prototype.encrypt = function (t) {
+ var e = function (t, e) {
+ if (e < t.length + 11) return console.error("Message too long for RSA"), null;
+ for (var i = [], r = t.length - 1; r >= 0 && e > 0;) {
+ var n = t.charCodeAt(r--);
+ n < 128 ? i[--e] = n : n > 127 && n < 2048 ? (i[--e] = 63 & n | 128, i[--e] = n >> 6 | 192) : (i[--e] = 63 & n | 128, i[--e] = n >> 6 & 63 | 128, i[--e] = n >> 12 | 224)
+ }
+ i[--e] = 0;
+ for (var s = new J, o = []; e > 2;) {
+ for (o[0] = 0; 0 == o[0];) s.nextBytes(o);
+ i[--e] = o[0]
+ }
+ return i[--e] = 2, i[--e] = 0, new B(i)
+ }(t, this.n.bitLength() + 7 >> 3);
+ if (null == e) return null;
+ var i = this.doPublic(e);
+ if (null == i) return null;
+ var r = i.toString(16);
+ return 0 == (1 & r.length) ? r : "0" + r
+ }, t.prototype.setPrivate = function (t, e, i) {
+ null != t && null != e && t.length > 0 && e.length > 0 ? (this.n = P(t, 16), this.e = parseInt(e, 16), this.d = P(i, 16)) : console.error("Invalid RSA private key")
+ }, t.prototype.setPrivateEx = function (t, e, i, r, n, s, o, h) {
+ null != t && null != e && t.length > 0 && e.length > 0 ? (this.n = P(t, 16), this.e = parseInt(e, 16), this.d = P(i, 16), this.p = P(r, 16), this.q = P(n, 16), this.dmp1 = P(s, 16), this.dmq1 = P(o, 16), this.coeff = P(h, 16)) : console.error("Invalid RSA private key")
+ }, t.prototype.generate = function (t, e) {
+ var i = new J, r = t >> 1;
+ this.e = parseInt(e, 16);
+ for (var n = new B(e, 16); ;) {
+ for (; this.p = new B(t - r, 1, i), 0 != this.p.subtract(B.ONE).gcd(n).compareTo(B.ONE) || !this.p.isProbablePrime(10);) ;
+ for (; this.q = new B(r, 1, i), 0 != this.q.subtract(B.ONE).gcd(n).compareTo(B.ONE) || !this.q.isProbablePrime(10);) ;
+ if (this.p.compareTo(this.q) <= 0) {
+ var s = this.p;
+ this.p = this.q, this.q = s
+ }
+ var o = this.p.subtract(B.ONE), h = this.q.subtract(B.ONE), a = o.multiply(h);
+ if (0 == a.gcd(n).compareTo(B.ONE)) {
+ this.n = this.p.multiply(this.q), this.d = n.modInverse(a), this.dmp1 = this.d.mod(o), this.dmq1 = this.d.mod(h), this.coeff = this.q.modInverse(this.p);
+ break
+ }
+ }
+ }, t.prototype.decrypt = function (t) {
+ var e = P(t, 16), i = this.doPrivate(e);
+ return null == i ? null : function (t, e) {
+ for (var i = t.toByteArray(), r = 0; r < i.length && 0 == i[r];) ++r;
+ if (i.length - r != e - 1 || 2 != i[r]) return null;
+ for (++r; 0 != i[r];) if (++r >= i.length) return null;
+ for (var n = ""; ++r < i.length;) {
+ var s = 255 & i[r];
+ s < 128 ? n += String.fromCharCode(s) : s > 191 && s < 224 ? (n += String.fromCharCode((31 & s) << 6 | 63 & i[r + 1]), ++r) : (n += String.fromCharCode((15 & s) << 12 | (63 & i[r + 1]) << 6 | 63 & i[r + 2]), r += 2)
+ }
+ return n
+ }(i, this.n.bitLength() + 7 >> 3)
+ }, t.prototype.generateAsync = function (t, e, i) {
+ var r = new J, n = t >> 1;
+ this.e = parseInt(e, 16);
+ var s = new B(e, 16), o = this, h = function () {
+ var e = function () {
+ if (o.p.compareTo(o.q) <= 0) {
+ var t = o.p;
+ o.p = o.q, o.q = t
+ }
+ var e = o.p.subtract(B.ONE), r = o.q.subtract(B.ONE), n = e.multiply(r);
+ 0 == n.gcd(s).compareTo(B.ONE) ? (o.n = o.p.multiply(o.q), o.d = s.modInverse(n), o.dmp1 = o.d.mod(e), o.dmq1 = o.d.mod(r), o.coeff = o.q.modInverse(o.p), setTimeout((function () {
+ i()
+ }), 0)) : setTimeout(h, 0)
+ }, a = function () {
+ o.q = N(), o.q.fromNumberAsync(n, 1, r, (function () {
+ o.q.subtract(B.ONE).gcda(s, (function (t) {
+ 0 == t.compareTo(B.ONE) && o.q.isProbablePrime(10) ? setTimeout(e, 0) : setTimeout(a, 0)
+ }))
+ }))
+ }, u = function () {
+ o.p = N(), o.p.fromNumberAsync(t - n, 1, r, (function () {
+ o.p.subtract(B.ONE).gcda(s, (function (t) {
+ 0 == t.compareTo(B.ONE) && o.p.isProbablePrime(10) ? setTimeout(a, 0) : setTimeout(u, 0)
+ }))
+ }))
+ };
+ setTimeout(u, 0)
+ };
+ setTimeout(h, 0)
+ }, t.prototype.sign = function (t, e, i) {
+ var r = function (t, e) {
+ if (e < t.length + 22) return console.error("Message too long for RSA"), null;
+ for (var i = e - t.length - 6, r = "", n = 0; n < i; n += 2) r += "ff";
+ return P("0001" + r + "00" + t, 16)
+ }((Q[i] || "") + e(t).toString(), this.n.bitLength() / 4);
+ if (null == r) return null;
+ var n = this.doPrivate(r);
+ if (null == n) return null;
+ var s = n.toString(16);
+ return 0 == (1 & s.length) ? s : "0" + s
+ }, t.prototype.verify = function (t, e, i) {
+ var r = P(e, 16), n = this.doPublic(r);
+ return null == n ? null : function (t) {
+ for (var e in Q) if (Q.hasOwnProperty(e)) {
+ var i = Q[e], r = i.length;
+ if (t.substr(0, r) == i) return t.substr(r)
+ }
+ return t
+ }(n.toString(16).replace(/^1f+00/, "")) == i(t).toString()
+ }, t
+ }(), Q = {
+ md2: "3020300c06082a864886f70d020205000410",
+ md5: "3020300c06082a864886f70d020505000410",
+ sha1: "3021300906052b0e03021a05000414",
+ sha224: "302d300d06096086480165030402040500041c",
+ sha256: "3031300d060960864801650304020105000420",
+ sha384: "3041300d060960864801650304020205000430",
+ sha512: "3051300d060960864801650304020305000440",
+ ripemd160: "3021300906052b2403020105000414"
+ }, W = {};
+ W.lang = {
+ extend: function (t, e, i) {
+ if (!e || !t) throw new Error("YAHOO.lang.extend failed, please check that all dependencies are included.");
+ var r = function () {
+ };
+ if (r.prototype = e.prototype, t.prototype = new r, t.prototype.constructor = t, t.superclass = e.prototype, e.prototype.constructor == Object.prototype.constructor && (e.prototype.constructor = e), i) {
+ var n;
+ for (n in i) t.prototype[n] = i[n];
+ var s = function () {
+ }, o = ["toString", "valueOf"];
+ try {
+ /MSIE/.test(navigator.userAgent) && (s = function (t, e) {
+ for (n = 0; n < o.length; n += 1) {
+ var i = o[n], r = e[i];
+ "function" == typeof r && r != Object.prototype[i] && (t[i] = r)
+ }
+ })
+ } catch (t) {
+ }
+ s(t.prototype, i)
+ }
+ }
+ };
+ var tt = {};
+ void 0 !== tt.asn1 && tt.asn1 || (tt.asn1 = {}), tt.asn1.ASN1Util = new function () {
+ this.integerToByteHex = function (t) {
+ var e = t.toString(16);
+ return e.length % 2 == 1 && (e = "0" + e), e
+ }, this.bigIntToMinTwosComplementsHex = function (t) {
+ var e = t.toString(16);
+ if ("-" != e.substr(0, 1)) e.length % 2 == 1 ? e = "0" + e : e.match(/^[0-7]/) || (e = "00" + e); else {
+ var i = e.substr(1).length;
+ i % 2 == 1 ? i += 1 : e.match(/^[0-7]/) || (i += 2);
+ for (var r = "", n = 0; n < i; n++) r += "f";
+ e = new B(r, 16).xor(t).add(B.ONE).toString(16).replace(/^-/, "")
+ }
+ return e
+ }, this.getPEMStringFromHex = function (t, e) {
+ return hextopem(t, e)
+ }, this.newObject = function (t) {
+ var e = tt.asn1, i = e.DERBoolean, r = e.DERInteger, n = e.DERBitString, s = e.DEROctetString,
+ o = e.DERNull, h = e.DERObjectIdentifier, a = e.DEREnumerated, u = e.DERUTF8String,
+ c = e.DERNumericString, f = e.DERPrintableString, l = e.DERTeletexString,
+ p = e.DERIA5String, g = e.DERUTCTime, d = e.DERGeneralizedTime, v = e.DERSequence,
+ m = e.DERSet, y = e.DERTaggedObject, b = e.ASN1Util.newObject, T = Object.keys(t);
+ if (1 != T.length) throw"key of param shall be only one.";
+ var S = T[0];
+ if (-1 == ":bool:int:bitstr:octstr:null:oid:enum:utf8str:numstr:prnstr:telstr:ia5str:utctime:gentime:seq:set:tag:".indexOf(":" + S + ":")) throw"undefined key: " + S;
+ if ("bool" == S) return new i(t[S]);
+ if ("int" == S) return new r(t[S]);
+ if ("bitstr" == S) return new n(t[S]);
+ if ("octstr" == S) return new s(t[S]);
+ if ("null" == S) return new o(t[S]);
+ if ("oid" == S) return new h(t[S]);
+ if ("enum" == S) return new a(t[S]);
+ if ("utf8str" == S) return new u(t[S]);
+ if ("numstr" == S) return new c(t[S]);
+ if ("prnstr" == S) return new f(t[S]);
+ if ("telstr" == S) return new l(t[S]);
+ if ("ia5str" == S) return new p(t[S]);
+ if ("utctime" == S) return new g(t[S]);
+ if ("gentime" == S) return new d(t[S]);
+ if ("seq" == S) {
+ for (var E = t[S], w = [], D = 0; D < E.length; D++) {
+ var x = b(E[D]);
+ w.push(x)
+ }
+ return new v({array: w})
+ }
+ if ("set" == S) {
+ for (E = t[S], w = [], D = 0; D < E.length; D++) x = b(E[D]), w.push(x);
+ return new m({array: w})
+ }
+ if ("tag" == S) {
+ var R = t[S];
+ if ("[object Array]" === Object.prototype.toString.call(R) && 3 == R.length) {
+ var B = b(R[2]);
+ return new y({tag: R[0], explicit: R[1], obj: B})
+ }
+ var O = {};
+ if (void 0 !== R.explicit && (O.explicit = R.explicit), void 0 !== R.tag && (O.tag = R.tag), void 0 === R.obj) throw"obj shall be specified for 'tag'.";
+ return O.obj = b(R.obj), new y(O)
+ }
+ }, this.jsonToASN1HEX = function (t) {
+ return this.newObject(t).getEncodedHex()
+ }
+ }, tt.asn1.ASN1Util.oidHexToInt = function (t) {
+ for (var e = "", i = parseInt(t.substr(0, 2), 16), r = (e = Math.floor(i / 40) + "." + i % 40, ""), n = 2; n < t.length; n += 2) {
+ var s = ("00000000" + parseInt(t.substr(n, 2), 16).toString(2)).slice(-8);
+ r += s.substr(1, 7), "0" == s.substr(0, 1) && (e = e + "." + new B(r, 2).toString(10), r = "")
+ }
+ return e
+ }, tt.asn1.ASN1Util.oidIntToHex = function (t) {
+ var e = function (t) {
+ var e = t.toString(16);
+ return 1 == e.length && (e = "0" + e), e
+ }, i = function (t) {
+ var i = "", r = new B(t, 10).toString(2), n = 7 - r.length % 7;
+ 7 == n && (n = 0);
+ for (var s = "", o = 0; o < n; o++) s += "0";
+ for (r = s + r, o = 0; o < r.length - 1; o += 7) {
+ var h = r.substr(o, 7);
+ o != r.length - 7 && (h = "1" + h), i += e(parseInt(h, 2))
+ }
+ return i
+ };
+ if (!t.match(/^[0-9.]+$/)) throw"malformed oid string: " + t;
+ var r = "", n = t.split("."), s = 40 * parseInt(n[0]) + parseInt(n[1]);
+ r += e(s), n.splice(0, 2);
+ for (var o = 0; o < n.length; o++) r += i(n[o]);
+ return r
+ }, tt.asn1.ASN1Object = function () {
+ this.getLengthHexFromValue = function () {
+ if (void 0 === this.hV || null == this.hV) throw"this.hV is null or undefined.";
+ if (this.hV.length % 2 == 1) throw"value hex must be even length: n=" + "".length + ",v=" + this.hV;
+ var t = this.hV.length / 2, e = t.toString(16);
+ if (e.length % 2 == 1 && (e = "0" + e), t < 128) return e;
+ var i = e.length / 2;
+ if (i > 15) throw"ASN.1 length too long to represent by 8x: n = " + t.toString(16);
+ return (128 + i).toString(16) + e
+ }, this.getEncodedHex = function () {
+ return (null == this.hTLV || this.isModified) && (this.hV = this.getFreshValueHex(), this.hL = this.getLengthHexFromValue(), this.hTLV = this.hT + this.hL + this.hV, this.isModified = !1), this.hTLV
+ }, this.getValueHex = function () {
+ return this.getEncodedHex(), this.hV
+ }, this.getFreshValueHex = function () {
+ return ""
+ }
+ }, tt.asn1.DERAbstractString = function (t) {
+ tt.asn1.DERAbstractString.superclass.constructor.call(this), this.getString = function () {
+ return this.s
+ }, this.setString = function (t) {
+ this.hTLV = null, this.isModified = !0, this.s = t, this.hV = stohex(this.s)
+ }, this.setStringHex = function (t) {
+ this.hTLV = null, this.isModified = !0, this.s = null, this.hV = t
+ }, this.getFreshValueHex = function () {
+ return this.hV
+ }, void 0 !== t && ("string" == typeof t ? this.setString(t) : void 0 !== t.str ? this.setString(t.str) : void 0 !== t.hex && this.setStringHex(t.hex))
+ }, W.lang.extend(tt.asn1.DERAbstractString, tt.asn1.ASN1Object), tt.asn1.DERAbstractTime = function (t) {
+ tt.asn1.DERAbstractTime.superclass.constructor.call(this), this.localDateToUTC = function (t) {
+ return utc = t.getTime() + 6e4 * t.getTimezoneOffset(), new Date(utc)
+ }, this.formatDate = function (t, e, i) {
+ var r = this.zeroPadding, n = this.localDateToUTC(t), s = String(n.getFullYear());
+ "utc" == e && (s = s.substr(2, 2));
+ var o = s + r(String(n.getMonth() + 1), 2) + r(String(n.getDate()), 2) + r(String(n.getHours()), 2) + r(String(n.getMinutes()), 2) + r(String(n.getSeconds()), 2);
+ if (!0 === i) {
+ var h = n.getMilliseconds();
+ if (0 != h) {
+ var a = r(String(h), 3);
+ o = o + "." + (a = a.replace(/[0]+$/, ""))
+ }
+ }
+ return o + "Z"
+ }, this.zeroPadding = function (t, e) {
+ return t.length >= e ? t : new Array(e - t.length + 1).join("0") + t
+ }, this.getString = function () {
+ return this.s
+ }, this.setString = function (t) {
+ this.hTLV = null, this.isModified = !0, this.s = t, this.hV = stohex(t)
+ }, this.setByDateValue = function (t, e, i, r, n, s) {
+ var o = new Date(Date.UTC(t, e - 1, i, r, n, s, 0));
+ this.setByDate(o)
+ }, this.getFreshValueHex = function () {
+ return this.hV
+ }
+ }, W.lang.extend(tt.asn1.DERAbstractTime, tt.asn1.ASN1Object), tt.asn1.DERAbstractStructured = function (t) {
+ tt.asn1.DERAbstractString.superclass.constructor.call(this), this.setByASN1ObjectArray = function (t) {
+ this.hTLV = null, this.isModified = !0, this.asn1Array = t
+ }, this.appendASN1Object = function (t) {
+ this.hTLV = null, this.isModified = !0, this.asn1Array.push(t)
+ }, this.asn1Array = new Array, void 0 !== t && void 0 !== t.array && (this.asn1Array = t.array)
+ }, W.lang.extend(tt.asn1.DERAbstractStructured, tt.asn1.ASN1Object), tt.asn1.DERBoolean = function () {
+ tt.asn1.DERBoolean.superclass.constructor.call(this), this.hT = "01", this.hTLV = "0101ff"
+ }, W.lang.extend(tt.asn1.DERBoolean, tt.asn1.ASN1Object), tt.asn1.DERInteger = function (t) {
+ tt.asn1.DERInteger.superclass.constructor.call(this), this.hT = "02", this.setByBigInteger = function (t) {
+ this.hTLV = null, this.isModified = !0, this.hV = tt.asn1.ASN1Util.bigIntToMinTwosComplementsHex(t)
+ }, this.setByInteger = function (t) {
+ var e = new B(String(t), 10);
+ this.setByBigInteger(e)
+ }, this.setValueHex = function (t) {
+ this.hV = t
+ }, this.getFreshValueHex = function () {
+ return this.hV
+ }, void 0 !== t && (void 0 !== t.bigint ? this.setByBigInteger(t.bigint) : void 0 !== t.int ? this.setByInteger(t.int) : "number" == typeof t ? this.setByInteger(t) : void 0 !== t.hex && this.setValueHex(t.hex))
+ }, W.lang.extend(tt.asn1.DERInteger, tt.asn1.ASN1Object), tt.asn1.DERBitString = function (t) {
+ if (void 0 !== t && void 0 !== t.obj) {
+ var e = tt.asn1.ASN1Util.newObject(t.obj);
+ t.hex = "00" + e.getEncodedHex()
+ }
+ tt.asn1.DERBitString.superclass.constructor.call(this), this.hT = "03", this.setHexValueIncludingUnusedBits = function (t) {
+ this.hTLV = null, this.isModified = !0, this.hV = t
+ }, this.setUnusedBitsAndHexValue = function (t, e) {
+ if (t < 0 || 7 < t) throw"unused bits shall be from 0 to 7: u = " + t;
+ var i = "0" + t;
+ this.hTLV = null, this.isModified = !0, this.hV = i + e
+ }, this.setByBinaryString = function (t) {
+ var e = 8 - (t = t.replace(/0+$/, "")).length % 8;
+ 8 == e && (e = 0);
+ for (var i = 0; i <= e; i++) t += "0";
+ var r = "";
+ for (i = 0; i < t.length - 1; i += 8) {
+ var n = t.substr(i, 8), s = parseInt(n, 2).toString(16);
+ 1 == s.length && (s = "0" + s), r += s
+ }
+ this.hTLV = null, this.isModified = !0, this.hV = "0" + e + r
+ }, this.setByBooleanArray = function (t) {
+ for (var e = "", i = 0; i < t.length; i++) 1 == t[i] ? e += "1" : e += "0";
+ this.setByBinaryString(e)
+ }, this.newFalseArray = function (t) {
+ for (var e = new Array(t), i = 0; i < t; i++) e[i] = !1;
+ return e
+ }, this.getFreshValueHex = function () {
+ return this.hV
+ }, void 0 !== t && ("string" == typeof t && t.toLowerCase().match(/^[0-9a-f]+$/) ? this.setHexValueIncludingUnusedBits(t) : void 0 !== t.hex ? this.setHexValueIncludingUnusedBits(t.hex) : void 0 !== t.bin ? this.setByBinaryString(t.bin) : void 0 !== t.array && this.setByBooleanArray(t.array))
+ }, W.lang.extend(tt.asn1.DERBitString, tt.asn1.ASN1Object), tt.asn1.DEROctetString = function (t) {
+ if (void 0 !== t && void 0 !== t.obj) {
+ var e = tt.asn1.ASN1Util.newObject(t.obj);
+ t.hex = e.getEncodedHex()
+ }
+ tt.asn1.DEROctetString.superclass.constructor.call(this, t), this.hT = "04"
+ }, W.lang.extend(tt.asn1.DEROctetString, tt.asn1.DERAbstractString), tt.asn1.DERNull = function () {
+ tt.asn1.DERNull.superclass.constructor.call(this), this.hT = "05", this.hTLV = "0500"
+ }, W.lang.extend(tt.asn1.DERNull, tt.asn1.ASN1Object), tt.asn1.DERObjectIdentifier = function (t) {
+ var e = function (t) {
+ var e = t.toString(16);
+ return 1 == e.length && (e = "0" + e), e
+ }, i = function (t) {
+ var i = "", r = new B(t, 10).toString(2), n = 7 - r.length % 7;
+ 7 == n && (n = 0);
+ for (var s = "", o = 0; o < n; o++) s += "0";
+ for (r = s + r, o = 0; o < r.length - 1; o += 7) {
+ var h = r.substr(o, 7);
+ o != r.length - 7 && (h = "1" + h), i += e(parseInt(h, 2))
+ }
+ return i
+ };
+ tt.asn1.DERObjectIdentifier.superclass.constructor.call(this), this.hT = "06", this.setValueHex = function (t) {
+ this.hTLV = null, this.isModified = !0, this.s = null, this.hV = t
+ }, this.setValueOidString = function (t) {
+ if (!t.match(/^[0-9.]+$/)) throw"malformed oid string: " + t;
+ var r = "", n = t.split("."), s = 40 * parseInt(n[0]) + parseInt(n[1]);
+ r += e(s), n.splice(0, 2);
+ for (var o = 0; o < n.length; o++) r += i(n[o]);
+ this.hTLV = null, this.isModified = !0, this.s = null, this.hV = r
+ }, this.setValueName = function (t) {
+ var e = tt.asn1.x509.OID.name2oid(t);
+ if ("" === e) throw"DERObjectIdentifier oidName undefined: " + t;
+ this.setValueOidString(e)
+ }, this.getFreshValueHex = function () {
+ return this.hV
+ }, void 0 !== t && ("string" == typeof t ? t.match(/^[0-2].[0-9.]+$/) ? this.setValueOidString(t) : this.setValueName(t) : void 0 !== t.oid ? this.setValueOidString(t.oid) : void 0 !== t.hex ? this.setValueHex(t.hex) : void 0 !== t.name && this.setValueName(t.name))
+ }, W.lang.extend(tt.asn1.DERObjectIdentifier, tt.asn1.ASN1Object), tt.asn1.DEREnumerated = function (t) {
+ tt.asn1.DEREnumerated.superclass.constructor.call(this), this.hT = "0a", this.setByBigInteger = function (t) {
+ this.hTLV = null, this.isModified = !0, this.hV = tt.asn1.ASN1Util.bigIntToMinTwosComplementsHex(t)
+ }, this.setByInteger = function (t) {
+ var e = new B(String(t), 10);
+ this.setByBigInteger(e)
+ }, this.setValueHex = function (t) {
+ this.hV = t
+ }, this.getFreshValueHex = function () {
+ return this.hV
+ }, void 0 !== t && (void 0 !== t.int ? this.setByInteger(t.int) : "number" == typeof t ? this.setByInteger(t) : void 0 !== t.hex && this.setValueHex(t.hex))
+ }, W.lang.extend(tt.asn1.DEREnumerated, tt.asn1.ASN1Object), tt.asn1.DERUTF8String = function (t) {
+ tt.asn1.DERUTF8String.superclass.constructor.call(this, t), this.hT = "0c"
+ }, W.lang.extend(tt.asn1.DERUTF8String, tt.asn1.DERAbstractString), tt.asn1.DERNumericString = function (t) {
+ tt.asn1.DERNumericString.superclass.constructor.call(this, t), this.hT = "12"
+ }, W.lang.extend(tt.asn1.DERNumericString, tt.asn1.DERAbstractString), tt.asn1.DERPrintableString = function (t) {
+ tt.asn1.DERPrintableString.superclass.constructor.call(this, t), this.hT = "13"
+ }, W.lang.extend(tt.asn1.DERPrintableString, tt.asn1.DERAbstractString), tt.asn1.DERTeletexString = function (t) {
+ tt.asn1.DERTeletexString.superclass.constructor.call(this, t), this.hT = "14"
+ }, W.lang.extend(tt.asn1.DERTeletexString, tt.asn1.DERAbstractString), tt.asn1.DERIA5String = function (t) {
+ tt.asn1.DERIA5String.superclass.constructor.call(this, t), this.hT = "16"
+ }, W.lang.extend(tt.asn1.DERIA5String, tt.asn1.DERAbstractString), tt.asn1.DERUTCTime = function (t) {
+ tt.asn1.DERUTCTime.superclass.constructor.call(this, t), this.hT = "17", this.setByDate = function (t) {
+ this.hTLV = null, this.isModified = !0, this.date = t, this.s = this.formatDate(this.date, "utc"), this.hV = stohex(this.s)
+ }, this.getFreshValueHex = function () {
+ return void 0 === this.date && void 0 === this.s && (this.date = new Date, this.s = this.formatDate(this.date, "utc"), this.hV = stohex(this.s)), this.hV
+ }, void 0 !== t && (void 0 !== t.str ? this.setString(t.str) : "string" == typeof t && t.match(/^[0-9]{12}Z$/) ? this.setString(t) : void 0 !== t.hex ? this.setStringHex(t.hex) : void 0 !== t.date && this.setByDate(t.date))
+ }, W.lang.extend(tt.asn1.DERUTCTime, tt.asn1.DERAbstractTime), tt.asn1.DERGeneralizedTime = function (t) {
+ tt.asn1.DERGeneralizedTime.superclass.constructor.call(this, t), this.hT = "18", this.withMillis = !1, this.setByDate = function (t) {
+ this.hTLV = null, this.isModified = !0, this.date = t, this.s = this.formatDate(this.date, "gen", this.withMillis), this.hV = stohex(this.s)
+ }, this.getFreshValueHex = function () {
+ return void 0 === this.date && void 0 === this.s && (this.date = new Date, this.s = this.formatDate(this.date, "gen", this.withMillis), this.hV = stohex(this.s)), this.hV
+ }, void 0 !== t && (void 0 !== t.str ? this.setString(t.str) : "string" == typeof t && t.match(/^[0-9]{14}Z$/) ? this.setString(t) : void 0 !== t.hex ? this.setStringHex(t.hex) : void 0 !== t.date && this.setByDate(t.date), !0 === t.millis && (this.withMillis = !0))
+ }, W.lang.extend(tt.asn1.DERGeneralizedTime, tt.asn1.DERAbstractTime), tt.asn1.DERSequence = function (t) {
+ tt.asn1.DERSequence.superclass.constructor.call(this, t), this.hT = "30", this.getFreshValueHex = function () {
+ for (var t = "", e = 0; e < this.asn1Array.length; e++) t += this.asn1Array[e].getEncodedHex();
+ return this.hV = t, this.hV
+ }
+ }, W.lang.extend(tt.asn1.DERSequence, tt.asn1.DERAbstractStructured), tt.asn1.DERSet = function (t) {
+ tt.asn1.DERSet.superclass.constructor.call(this, t), this.hT = "31", this.sortFlag = !0, this.getFreshValueHex = function () {
+ for (var t = new Array, e = 0; e < this.asn1Array.length; e++) {
+ var i = this.asn1Array[e];
+ t.push(i.getEncodedHex())
+ }
+ return 1 == this.sortFlag && t.sort(), this.hV = t.join(""), this.hV
+ }, void 0 !== t && void 0 !== t.sortflag && 0 == t.sortflag && (this.sortFlag = !1)
+ }, W.lang.extend(tt.asn1.DERSet, tt.asn1.DERAbstractStructured), tt.asn1.DERTaggedObject = function (t) {
+ tt.asn1.DERTaggedObject.superclass.constructor.call(this), this.hT = "a0", this.hV = "", this.isExplicit = !0, this.asn1Object = null, this.setASN1Object = function (t, e, i) {
+ this.hT = e, this.isExplicit = t, this.asn1Object = i, this.isExplicit ? (this.hV = this.asn1Object.getEncodedHex(), this.hTLV = null, this.isModified = !0) : (this.hV = null, this.hTLV = i.getEncodedHex(), this.hTLV = this.hTLV.replace(/^../, e), this.isModified = !1)
+ }, this.getFreshValueHex = function () {
+ return this.hV
+ }, void 0 !== t && (void 0 !== t.tag && (this.hT = t.tag), void 0 !== t.explicit && (this.isExplicit = t.explicit), void 0 !== t.obj && (this.asn1Object = t.obj, this.setASN1Object(this.isExplicit, this.hT, this.asn1Object)))
+ }, W.lang.extend(tt.asn1.DERTaggedObject, tt.asn1.ASN1Object);
+ var et, it = (et = function (t, e) {
+ return (et = Object.setPrototypeOf || {__proto__: []} instanceof Array && function (t, e) {
+ t.__proto__ = e
+ } || function (t, e) {
+ for (var i in e) Object.prototype.hasOwnProperty.call(e, i) && (t[i] = e[i])
+ })(t, e)
+ }, function (t, e) {
+ function i() {
+ this.constructor = t
+ }
+
+ et(t, e), t.prototype = null === e ? Object.create(e) : (i.prototype = e.prototype, new i)
+ }), rt = function (t) {
+ function e(i) {
+ var r = t.call(this) || this;
+ return i && ("string" == typeof i ? r.parseKey(i) : (e.hasPrivateKeyProperty(i) || e.hasPublicKeyProperty(i)) && r.parsePropertiesFrom(i)), r
+ }
+
+ return it(e, t), e.prototype.parseKey = function (t) {
+ try {
+ var e = 0, i = 0, r = /^\s*(?:[0-9A-Fa-f][0-9A-Fa-f]\s*)+$/.test(t) ? function (t) {
+ var e;
+ if (void 0 === c) {
+ var i = "0123456789ABCDEF", r = " \f\n\r\t \u2028\u2029";
+ for (c = {}, e = 0; e < 16; ++e) c[i.charAt(e)] = e;
+ for (i = i.toLowerCase(), e = 10; e < 16; ++e) c[i.charAt(e)] = e;
+ for (e = 0; e < r.length; ++e) c[r.charAt(e)] = -1
+ }
+ var n = [], s = 0, o = 0;
+ for (e = 0; e < t.length; ++e) {
+ var h = t.charAt(e);
+ if ("=" == h) break;
+ if (-1 != (h = c[h])) {
+ if (void 0 === h) throw new Error("Illegal character at offset " + e);
+ s |= h, ++o >= 2 ? (n[n.length] = s, s = 0, o = 0) : s <<= 4
+ }
+ }
+ if (o) throw new Error("Hex encoding incomplete: 4 bits missing");
+ return n
+ }(t) : d.unarmor(t), n = w.decode(r);
+ if (3 === n.sub.length && (n = n.sub[2].sub[0]), 9 === n.sub.length) {
+ e = n.sub[1].getHexStringValue(), this.n = P(e, 16), i = n.sub[2].getHexStringValue(), this.e = parseInt(i, 16);
+ var s = n.sub[3].getHexStringValue();
+ this.d = P(s, 16);
+ var o = n.sub[4].getHexStringValue();
+ this.p = P(o, 16);
+ var h = n.sub[5].getHexStringValue();
+ this.q = P(h, 16);
+ var a = n.sub[6].getHexStringValue();
+ this.dmp1 = P(a, 16);
+ var u = n.sub[7].getHexStringValue();
+ this.dmq1 = P(u, 16);
+ var f = n.sub[8].getHexStringValue();
+ this.coeff = P(f, 16)
+ } else {
+ if (2 !== n.sub.length) return !1;
+ var l = n.sub[1].sub[0];
+ e = l.sub[0].getHexStringValue(), this.n = P(e, 16), i = l.sub[1].getHexStringValue(), this.e = parseInt(i, 16)
+ }
+ return !0
+ } catch (t) {
+ return !1
+ }
+ }, e.prototype.getPrivateBaseKey = function () {
+ var t = {array: [new tt.asn1.DERInteger({int: 0}), new tt.asn1.DERInteger({bigint: this.n}), new tt.asn1.DERInteger({int: this.e}), new tt.asn1.DERInteger({bigint: this.d}), new tt.asn1.DERInteger({bigint: this.p}), new tt.asn1.DERInteger({bigint: this.q}), new tt.asn1.DERInteger({bigint: this.dmp1}), new tt.asn1.DERInteger({bigint: this.dmq1}), new tt.asn1.DERInteger({bigint: this.coeff})]};
+ return new tt.asn1.DERSequence(t).getEncodedHex()
+ }, e.prototype.getPrivateBaseKeyB64 = function () {
+ return l(this.getPrivateBaseKey())
+ }, e.prototype.getPublicBaseKey = function () {
+ var t = new tt.asn1.DERSequence({array: [new tt.asn1.DERObjectIdentifier({oid: "1.2.840.113549.1.1.1"}), new tt.asn1.DERNull]}),
+ e = new tt.asn1.DERSequence({array: [new tt.asn1.DERInteger({bigint: this.n}), new tt.asn1.DERInteger({int: this.e})]}),
+ i = new tt.asn1.DERBitString({hex: "00" + e.getEncodedHex()});
+ return new tt.asn1.DERSequence({array: [t, i]}).getEncodedHex()
+ }, e.prototype.getPublicBaseKeyB64 = function () {
+ return l(this.getPublicBaseKey())
+ }, e.wordwrap = function (t, e) {
+ if (!t) return t;
+ var i = "(.{1," + (e = e || 64) + "})( +|$\n?)|(.{1," + e + "})";
+ return t.match(RegExp(i, "g")).join("\n")
+ }, e.prototype.getPrivateKey = function () {
+ var t = "-----BEGIN RSA PRIVATE KEY-----\n";
+ return (t += e.wordwrap(this.getPrivateBaseKeyB64()) + "\n") + "-----END RSA PRIVATE KEY-----"
+ }, e.prototype.getPublicKey = function () {
+ var t = "-----BEGIN PUBLIC KEY-----\n";
+ return (t += e.wordwrap(this.getPublicBaseKeyB64()) + "\n") + "-----END PUBLIC KEY-----"
+ }, e.hasPublicKeyProperty = function (t) {
+ return (t = t || {}).hasOwnProperty("n") && t.hasOwnProperty("e")
+ }, e.hasPrivateKeyProperty = function (t) {
+ return (t = t || {}).hasOwnProperty("n") && t.hasOwnProperty("e") && t.hasOwnProperty("d") && t.hasOwnProperty("p") && t.hasOwnProperty("q") && t.hasOwnProperty("dmp1") && t.hasOwnProperty("dmq1") && t.hasOwnProperty("coeff")
+ }, e.prototype.parsePropertiesFrom = function (t) {
+ this.n = t.n, this.e = t.e, t.hasOwnProperty("d") && (this.d = t.d, this.p = t.p, this.q = t.q, this.dmp1 = t.dmp1, this.dmq1 = t.dmq1, this.coeff = t.coeff)
+ }, e
+ }(X);
+ const nt = function () {
+ function t(t) {
+ t = t || {}, this.default_key_size = t.default_key_size ? parseInt(t.default_key_size, 10) : 1024, this.default_public_exponent = t.default_public_exponent || "010001", this.log = t.log || !1, this.key = null
+ }
+
+ return t.prototype.setKey = function (t) {
+ this.log && this.key && console.warn("A key was already set, overriding existing."), this.key = new rt(t)
+ }, t.prototype.setPrivateKey = function (t) {
+ this.setKey(t)
+ }, t.prototype.setPublicKey = function (t) {
+ this.setKey(t)
+ }, t.prototype.decrypt = function (t) {
+ try {
+ return this.getKey().decrypt(p(t))
+ } catch (t) {
+ return !1
+ }
+ }, t.prototype.encrypt = function (t) {
+ try {
+ return l(this.getKey().encrypt(t))
+ } catch (t) {
+ return !1
+ }
+ }, t.prototype.sign = function (t, e, i) {
+ try {
+ return l(this.getKey().sign(t, e, i))
+ } catch (t) {
+ return !1
+ }
+ }, t.prototype.verify = function (t, e, i) {
+ try {
+ return this.getKey().verify(t, p(e), i)
+ } catch (t) {
+ return !1
+ }
+ }, t.prototype.getKey = function (t) {
+ if (!this.key) {
+ if (this.key = new rt, t && "[object Function]" === {}.toString.call(t)) return void this.key.generateAsync(this.default_key_size, this.default_public_exponent, t);
+ this.key.generate(this.default_key_size, this.default_public_exponent)
+ }
+ return this.key
+ }, t.prototype.getPrivateKey = function () {
+ return this.getKey().getPrivateKey()
+ }, t.prototype.getPrivateKeyB64 = function () {
+ return this.getKey().getPrivateBaseKeyB64()
+ }, t.prototype.getPublicKey = function () {
+ return this.getKey().getPublicKey()
+ }, t.prototype.getPublicKeyB64 = function () {
+ return this.getKey().getPublicBaseKeyB64()
+ }, t.version = "3.0.0-rc.2", t
+ }()
+ }
+ }, e = {};
+
+ function i(r) {
+ if (e[r]) return e[r].exports;
+ var n = e[r] = {exports: {}};
+ return t[r](n, n.exports, i), n.exports
+ }
+
+ return i.d = (t, e) => {
+ for (var r in e) i.o(e, r) && !i.o(t, r) && Object.defineProperty(t, r, {enumerable: !0, get: e[r]})
+ }, i.o = (t, e) => Object.prototype.hasOwnProperty.call(t, e), i(771)
+ })().default
+}));
\ No newline at end of file
diff --git a/src/main/resources/static/js/lay-config.js b/src/main/resources/static/js/lay-config.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/common/common.js b/src/main/resources/static/js/lay-module/common/common.js
old mode 100644
new mode 100755
index 7fab1e5..79dae95
--- a/src/main/resources/static/js/lay-module/common/common.js
+++ b/src/main/resources/static/js/lay-module/common/common.js
@@ -54,7 +54,7 @@ layui.define(['form','table'], function (exports) { //提示：模块也可以
submitPostReq,
formListenFun: function (layFilter, type, path, resultId, reqType) {
form.on(`submit(${layFilter})`, function (data) {
- var value = data.field.content;
+ var value = data.field.payload;
// 定义白名单正则表达式
var whitelistRegex = /^[a-zA-Z0-9_\s]+$/;
diff --git a/src/main/resources/static/js/lay-module/echarts/echarts.js b/src/main/resources/static/js/lay-module/echarts/echarts.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/echarts/echartsTheme.js b/src/main/resources/static/js/lay-module/echarts/echartsTheme.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/iconPicker/iconPickerFa.js b/src/main/resources/static/js/lay-module/iconPicker/iconPickerFa.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/layarea/layarea.js b/src/main/resources/static/js/lay-module/layarea/layarea.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/layuimini/miniAdmin.js b/src/main/resources/static/js/lay-module/layuimini/miniAdmin.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/layuimini/miniMenu.js b/src/main/resources/static/js/lay-module/layuimini/miniMenu.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/layuimini/miniTab.js b/src/main/resources/static/js/lay-module/layuimini/miniTab.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/layuimini/miniTheme.js b/src/main/resources/static/js/lay-module/layuimini/miniTheme.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/layuimini/miniTongji.js b/src/main/resources/static/js/lay-module/layuimini/miniTongji.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/step-lay/step.css b/src/main/resources/static/js/lay-module/step-lay/step.css
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/step-lay/step.js b/src/main/resources/static/js/lay-module/step-lay/step.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/tableSelect/tableSelect.js b/src/main/resources/static/js/lay-module/tableSelect/tableSelect.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/treetable-lay/treetable.css b/src/main/resources/static/js/lay-module/treetable-lay/treetable.css
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/treetable-lay/treetable.js b/src/main/resources/static/js/lay-module/treetable-lay/treetable.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/wangEditor/fonts/w-e-icon.woff b/src/main/resources/static/js/lay-module/wangEditor/fonts/w-e-icon.woff
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/wangEditor/wangEditor.css b/src/main/resources/static/js/lay-module/wangEditor/wangEditor.css
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/wangEditor/wangEditor.js b/src/main/resources/static/js/lay-module/wangEditor/wangEditor.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/wangEditor/wangEditor.min.css b/src/main/resources/static/js/lay-module/wangEditor/wangEditor.min.css
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/wangEditor/wangEditor.min.js b/src/main/resources/static/js/lay-module/wangEditor/wangEditor.min.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/lay-module/wangEditor/wangEditor.min.js.map b/src/main/resources/static/js/lay-module/wangEditor/wangEditor.min.js.map
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/md5.min.js b/src/main/resources/static/js/md5.min.js
new file mode 100755
index 0000000..b74f9e7
--- /dev/null
+++ b/src/main/resources/static/js/md5.min.js
@@ -0,0 +1,109 @@
+/**
+ * [js-md5]{@link https://github.com/emn178/js-md5}
+ *
+ * @namespace md5
+ * @version 0.7.3
+ * @author Chen, Yi-Cyuan [emn178@gmail.com]
+ * @copyright Chen, Yi-Cyuan 2014-2017
+ * @license MIT
+ */
+!function () {
+ "use strict";
+
+ function t(t) {
+ if (t) d[0] = d[16] = d[1] = d[2] = d[3] = d[4] = d[5] = d[6] = d[7] = d[8] = d[9] = d[10] = d[11] = d[12] = d[13] = d[14] = d[15] = 0, this.blocks = d, this.buffer8 = l; else if (a) {
+ var r = new ArrayBuffer(68);
+ this.buffer8 = new Uint8Array(r), this.blocks = new Uint32Array(r)
+ } else this.blocks = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+ this.h0 = this.h1 = this.h2 = this.h3 = this.start = this.bytes = this.hBytes = 0, this.finalized = this.hashed = !1, this.first = !0
+ }
+
+ var r = "input is invalid type", e = "object" == typeof window, i = e ? window : {};
+ i.JS_MD5_NO_WINDOW && (e = !1);
+ var s = !e && "object" == typeof self,
+ h = !i.JS_MD5_NO_NODE_JS && "object" == typeof process && process.versions && process.versions.node;
+ h ? i = global : s && (i = self);
+ var f = !i.JS_MD5_NO_COMMON_JS && "object" == typeof module && module.exports,
+ o = "function" == typeof define && define.amd,
+ a = !i.JS_MD5_NO_ARRAY_BUFFER && "undefined" != typeof ArrayBuffer, n = "0123456789abcdef".split(""),
+ u = [128, 32768, 8388608, -2147483648], y = [0, 8, 16, 24],
+ c = ["hex", "array", "digest", "buffer", "arrayBuffer", "base64"],
+ p = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".split(""), d = [], l;
+ if (a) {
+ var A = new ArrayBuffer(68);
+ l = new Uint8Array(A), d = new Uint32Array(A)
+ }
+ !i.JS_MD5_NO_NODE_JS && Array.isArray || (Array.isArray = function (t) {
+ return "[object Array]" === Object.prototype.toString.call(t)
+ }), !a || !i.JS_MD5_NO_ARRAY_BUFFER_IS_VIEW && ArrayBuffer.isView || (ArrayBuffer.isView = function (t) {
+ return "object" == typeof t && t.buffer && t.buffer.constructor === ArrayBuffer
+ });
+ var b = function (r) {
+ return function (e) {
+ return new t(!0).update(e)[r]()
+ }
+ }, v = function () {
+ var r = b("hex");
+ h && (r = w(r)), r.create = function () {
+ return new t
+ }, r.update = function (t) {
+ return r.create().update(t)
+ };
+ for (var e = 0; e < c.length; ++e) {
+ var i = c[e];
+ r[i] = b(i)
+ }
+ return r
+ }, w = function (t) {
+ var e = eval("require('crypto')"), i = eval("require('buffer').Buffer"), s = function (s) {
+ if ("string" == typeof s) return e.createHash("md5").update(s, "utf8").digest("hex");
+ if (null === s || void 0 === s) throw r;
+ return s.constructor === ArrayBuffer && (s = new Uint8Array(s)), Array.isArray(s) || ArrayBuffer.isView(s) || s.constructor === i ? e.createHash("md5").update(new i(s)).digest("hex") : t(s)
+ };
+ return s
+ };
+ t.prototype.update = function (t) {
+ if (!this.finalized) {
+ var e, i = typeof t;
+ if ("string" !== i) {
+ if ("object" !== i) throw r;
+ if (null === t) throw r;
+ if (a && t.constructor === ArrayBuffer) t = new Uint8Array(t); else if (!(Array.isArray(t) || a && ArrayBuffer.isView(t))) throw r;
+ e = !0
+ }
+ for (var s, h, f = 0, o = t.length, n = this.blocks, u = this.buffer8; f < o;) {
+ if (this.hashed && (this.hashed = !1, n[0] = n[16], n[16] = n[1] = n[2] = n[3] = n[4] = n[5] = n[6] = n[7] = n[8] = n[9] = n[10] = n[11] = n[12] = n[13] = n[14] = n[15] = 0), e) if (a) for (h = this.start; f < o && h < 64; ++f) u[h++] = t[f]; else for (h = this.start; f < o && h < 64; ++f) n[h >> 2] |= t[f] << y[3 & h++]; else if (a) for (h = this.start; f < o && h < 64; ++f) (s = t.charCodeAt(f)) < 128 ? u[h++] = s : s < 2048 ? (u[h++] = 192 | s >> 6, u[h++] = 128 | 63 & s) : s < 55296 || s >= 57344 ? (u[h++] = 224 | s >> 12, u[h++] = 128 | s >> 6 & 63, u[h++] = 128 | 63 & s) : (s = 65536 + ((1023 & s) << 10 | 1023 & t.charCodeAt(++f)), u[h++] = 240 | s >> 18, u[h++] = 128 | s >> 12 & 63, u[h++] = 128 | s >> 6 & 63, u[h++] = 128 | 63 & s); else for (h = this.start; f < o && h < 64; ++f) (s = t.charCodeAt(f)) < 128 ? n[h >> 2] |= s << y[3 & h++] : s < 2048 ? (n[h >> 2] |= (192 | s >> 6) << y[3 & h++], n[h >> 2] |= (128 | 63 & s) << y[3 & h++]) : s < 55296 || s >= 57344 ? (n[h >> 2] |= (224 | s >> 12) << y[3 & h++], n[h >> 2] |= (128 | s >> 6 & 63) << y[3 & h++], n[h >> 2] |= (128 | 63 & s) << y[3 & h++]) : (s = 65536 + ((1023 & s) << 10 | 1023 & t.charCodeAt(++f)), n[h >> 2] |= (240 | s >> 18) << y[3 & h++], n[h >> 2] |= (128 | s >> 12 & 63) << y[3 & h++], n[h >> 2] |= (128 | s >> 6 & 63) << y[3 & h++], n[h >> 2] |= (128 | 63 & s) << y[3 & h++]);
+ this.lastByteIndex = h, this.bytes += h - this.start, h >= 64 ? (this.start = h - 64, this.hash(), this.hashed = !0) : this.start = h
+ }
+ return this.bytes > 4294967295 && (this.hBytes += this.bytes / 4294967296 << 0, this.bytes = this.bytes % 4294967296), this
+ }
+ }, t.prototype.finalize = function () {
+ if (!this.finalized) {
+ this.finalized = !0;
+ var t = this.blocks, r = this.lastByteIndex;
+ t[r >> 2] |= u[3 & r], r >= 56 && (this.hashed || this.hash(), t[0] = t[16], t[16] = t[1] = t[2] = t[3] = t[4] = t[5] = t[6] = t[7] = t[8] = t[9] = t[10] = t[11] = t[12] = t[13] = t[14] = t[15] = 0), t[14] = this.bytes << 3, t[15] = this.hBytes << 3 | this.bytes >>> 29, this.hash()
+ }
+ }, t.prototype.hash = function () {
+ var t, r, e, i, s, h, f = this.blocks;
+ this.first ? r = ((r = ((t = ((t = f[0] - 680876937) << 7 | t >>> 25) - 271733879 << 0) ^ (e = ((e = (-271733879 ^ (i = ((i = (-1732584194 ^ 2004318071 & t) + f[1] - 117830708) << 12 | i >>> 20) + t << 0) & (-271733879 ^ t)) + f[2] - 1126478375) << 17 | e >>> 15) + i << 0) & (i ^ t)) + f[3] - 1316259209) << 22 | r >>> 10) + e << 0 : (t = this.h0, r = this.h1, e = this.h2, r = ((r += ((t = ((t += ((i = this.h3) ^ r & (e ^ i)) + f[0] - 680876936) << 7 | t >>> 25) + r << 0) ^ (e = ((e += (r ^ (i = ((i += (e ^ t & (r ^ e)) + f[1] - 389564586) << 12 | i >>> 20) + t << 0) & (t ^ r)) + f[2] + 606105819) << 17 | e >>> 15) + i << 0) & (i ^ t)) + f[3] - 1044525330) << 22 | r >>> 10) + e << 0), r = ((r += ((t = ((t += (i ^ r & (e ^ i)) + f[4] - 176418897) << 7 | t >>> 25) + r << 0) ^ (e = ((e += (r ^ (i = ((i += (e ^ t & (r ^ e)) + f[5] + 1200080426) << 12 | i >>> 20) + t << 0) & (t ^ r)) + f[6] - 1473231341) << 17 | e >>> 15) + i << 0) & (i ^ t)) + f[7] - 45705983) << 22 | r >>> 10) + e << 0, r = ((r += ((t = ((t += (i ^ r & (e ^ i)) + f[8] + 1770035416) << 7 | t >>> 25) + r << 0) ^ (e = ((e += (r ^ (i = ((i += (e ^ t & (r ^ e)) + f[9] - 1958414417) << 12 | i >>> 20) + t << 0) & (t ^ r)) + f[10] - 42063) << 17 | e >>> 15) + i << 0) & (i ^ t)) + f[11] - 1990404162) << 22 | r >>> 10) + e << 0, r = ((r += ((t = ((t += (i ^ r & (e ^ i)) + f[12] + 1804603682) << 7 | t >>> 25) + r << 0) ^ (e = ((e += (r ^ (i = ((i += (e ^ t & (r ^ e)) + f[13] - 40341101) << 12 | i >>> 20) + t << 0) & (t ^ r)) + f[14] - 1502002290) << 17 | e >>> 15) + i << 0) & (i ^ t)) + f[15] + 1236535329) << 22 | r >>> 10) + e << 0, r = ((r += ((i = ((i += (r ^ e & ((t = ((t += (e ^ i & (r ^ e)) + f[1] - 165796510) << 5 | t >>> 27) + r << 0) ^ r)) + f[6] - 1069501632) << 9 | i >>> 23) + t << 0) ^ t & ((e = ((e += (t ^ r & (i ^ t)) + f[11] + 643717713) << 14 | e >>> 18) + i << 0) ^ i)) + f[0] - 373897302) << 20 | r >>> 12) + e << 0, r = ((r += ((i = ((i += (r ^ e & ((t = ((t += (e ^ i & (r ^ e)) + f[5] - 701558691) << 5 | t >>> 27) + r << 0) ^ r)) + f[10] + 38016083) << 9 | i >>> 23) + t << 0) ^ t & ((e = ((e += (t ^ r & (i ^ t)) + f[15] - 660478335) << 14 | e >>> 18) + i << 0) ^ i)) + f[4] - 405537848) << 20 | r >>> 12) + e << 0, r = ((r += ((i = ((i += (r ^ e & ((t = ((t += (e ^ i & (r ^ e)) + f[9] + 568446438) << 5 | t >>> 27) + r << 0) ^ r)) + f[14] - 1019803690) << 9 | i >>> 23) + t << 0) ^ t & ((e = ((e += (t ^ r & (i ^ t)) + f[3] - 187363961) << 14 | e >>> 18) + i << 0) ^ i)) + f[8] + 1163531501) << 20 | r >>> 12) + e << 0, r = ((r += ((i = ((i += (r ^ e & ((t = ((t += (e ^ i & (r ^ e)) + f[13] - 1444681467) << 5 | t >>> 27) + r << 0) ^ r)) + f[2] - 51403784) << 9 | i >>> 23) + t << 0) ^ t & ((e = ((e += (t ^ r & (i ^ t)) + f[7] + 1735328473) << 14 | e >>> 18) + i << 0) ^ i)) + f[12] - 1926607734) << 20 | r >>> 12) + e << 0, r = ((r += ((h = (i = ((i += ((s = r ^ e) ^ (t = ((t += (s ^ i) + f[5] - 378558) << 4 | t >>> 28) + r << 0)) + f[8] - 2022574463) << 11 | i >>> 21) + t << 0) ^ t) ^ (e = ((e += (h ^ r) + f[11] + 1839030562) << 16 | e >>> 16) + i << 0)) + f[14] - 35309556) << 23 | r >>> 9) + e << 0, r = ((r += ((h = (i = ((i += ((s = r ^ e) ^ (t = ((t += (s ^ i) + f[1] - 1530992060) << 4 | t >>> 28) + r << 0)) + f[4] + 1272893353) << 11 | i >>> 21) + t << 0) ^ t) ^ (e = ((e += (h ^ r) + f[7] - 155497632) << 16 | e >>> 16) + i << 0)) + f[10] - 1094730640) << 23 | r >>> 9) + e << 0, r = ((r += ((h = (i = ((i += ((s = r ^ e) ^ (t = ((t += (s ^ i) + f[13] + 681279174) << 4 | t >>> 28) + r << 0)) + f[0] - 358537222) << 11 | i >>> 21) + t << 0) ^ t) ^ (e = ((e += (h ^ r) + f[3] - 722521979) << 16 | e >>> 16) + i << 0)) + f[6] + 76029189) << 23 | r >>> 9) + e << 0, r = ((r += ((h = (i = ((i += ((s = r ^ e) ^ (t = ((t += (s ^ i) + f[9] - 640364487) << 4 | t >>> 28) + r << 0)) + f[12] - 421815835) << 11 | i >>> 21) + t << 0) ^ t) ^ (e = ((e += (h ^ r) + f[15] + 530742520) << 16 | e >>> 16) + i << 0)) + f[2] - 995338651) << 23 | r >>> 9) + e << 0, r = ((r += ((i = ((i += (r ^ ((t = ((t += (e ^ (r | ~i)) + f[0] - 198630844) << 6 | t >>> 26) + r << 0) | ~e)) + f[7] + 1126891415) << 10 | i >>> 22) + t << 0) ^ ((e = ((e += (t ^ (i | ~r)) + f[14] - 1416354905) << 15 | e >>> 17) + i << 0) | ~t)) + f[5] - 57434055) << 21 | r >>> 11) + e << 0, r = ((r += ((i = ((i += (r ^ ((t = ((t += (e ^ (r | ~i)) + f[12] + 1700485571) << 6 | t >>> 26) + r << 0) | ~e)) + f[3] - 1894986606) << 10 | i >>> 22) + t << 0) ^ ((e = ((e += (t ^ (i | ~r)) + f[10] - 1051523) << 15 | e >>> 17) + i << 0) | ~t)) + f[1] - 2054922799) << 21 | r >>> 11) + e << 0, r = ((r += ((i = ((i += (r ^ ((t = ((t += (e ^ (r | ~i)) + f[8] + 1873313359) << 6 | t >>> 26) + r << 0) | ~e)) + f[15] - 30611744) << 10 | i >>> 22) + t << 0) ^ ((e = ((e += (t ^ (i | ~r)) + f[6] - 1560198380) << 15 | e >>> 17) + i << 0) | ~t)) + f[13] + 1309151649) << 21 | r >>> 11) + e << 0, r = ((r += ((i = ((i += (r ^ ((t = ((t += (e ^ (r | ~i)) + f[4] - 145523070) << 6 | t >>> 26) + r << 0) | ~e)) + f[11] - 1120210379) << 10 | i >>> 22) + t << 0) ^ ((e = ((e += (t ^ (i | ~r)) + f[2] + 718787259) << 15 | e >>> 17) + i << 0) | ~t)) + f[9] - 343485551) << 21 | r >>> 11) + e << 0, this.first ? (this.h0 = t + 1732584193 << 0, this.h1 = r - 271733879 << 0, this.h2 = e - 1732584194 << 0, this.h3 = i + 271733878 << 0, this.first = !1) : (this.h0 = this.h0 + t << 0, this.h1 = this.h1 + r << 0, this.h2 = this.h2 + e << 0, this.h3 = this.h3 + i << 0)
+ }, t.prototype.hex = function () {
+ this.finalize();
+ var t = this.h0, r = this.h1, e = this.h2, i = this.h3;
+ return n[t >> 4 & 15] + n[15 & t] + n[t >> 12 & 15] + n[t >> 8 & 15] + n[t >> 20 & 15] + n[t >> 16 & 15] + n[t >> 28 & 15] + n[t >> 24 & 15] + n[r >> 4 & 15] + n[15 & r] + n[r >> 12 & 15] + n[r >> 8 & 15] + n[r >> 20 & 15] + n[r >> 16 & 15] + n[r >> 28 & 15] + n[r >> 24 & 15] + n[e >> 4 & 15] + n[15 & e] + n[e >> 12 & 15] + n[e >> 8 & 15] + n[e >> 20 & 15] + n[e >> 16 & 15] + n[e >> 28 & 15] + n[e >> 24 & 15] + n[i >> 4 & 15] + n[15 & i] + n[i >> 12 & 15] + n[i >> 8 & 15] + n[i >> 20 & 15] + n[i >> 16 & 15] + n[i >> 28 & 15] + n[i >> 24 & 15]
+ }, t.prototype.toString = t.prototype.hex, t.prototype.digest = function () {
+ this.finalize();
+ var t = this.h0, r = this.h1, e = this.h2, i = this.h3;
+ return [255 & t, t >> 8 & 255, t >> 16 & 255, t >> 24 & 255, 255 & r, r >> 8 & 255, r >> 16 & 255, r >> 24 & 255, 255 & e, e >> 8 & 255, e >> 16 & 255, e >> 24 & 255, 255 & i, i >> 8 & 255, i >> 16 & 255, i >> 24 & 255]
+ }, t.prototype.array = t.prototype.digest, t.prototype.arrayBuffer = function () {
+ this.finalize();
+ var t = new ArrayBuffer(16), r = new Uint32Array(t);
+ return r[0] = this.h0, r[1] = this.h1, r[2] = this.h2, r[3] = this.h3, t
+ }, t.prototype.buffer = t.prototype.arrayBuffer, t.prototype.base64 = function () {
+ for (var t, r, e, i = "", s = this.array(), h = 0; h < 15;) t = s[h++], r = s[h++], e = s[h++], i += p[t >>> 2] + p[63 & (t << 4 | r >>> 4)] + p[63 & (r << 2 | e >>> 6)] + p[63 & e];
+ return t = s[h], i += p[t >>> 2] + p[t << 4 & 63] + "=="
+ };
+ var _ = v();
+ f ? module.exports = _ : (i.md5 = _, o && define(function () {
+ return _
+ }))
+}();
\ No newline at end of file
diff --git a/src/main/resources/static/js/sec-tip.js b/src/main/resources/static/js/sec-tip.js
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/js/staticcode.js b/src/main/resources/static/js/staticcode.js
old mode 100644
new mode 100755
index 6263990..d50001f
--- a/src/main/resources/static/js/staticcode.js
+++ b/src/main/resources/static/js/staticcode.js
@@ -4,9 +4,9 @@
* @email: whgojp@foxmail.com
* @Date: 2024/5/19 19:03
*/
-const vul1ReflectRaw = "// 原生漏洞环境,未加任何过滤，Controller接口返回Json类型结果\n" +
- "public R vul1(String content) {\n" +
- " return R.ok(content);\n" +
+const vul1ReflectRaw = "// 原生漏洞场景，未加任何过滤，Controller接口返回JSON类型结果\n" +
+ "public R vul1(String payload) {\n" +
+ " return R.ok(payload);\n" +
"}\n" +
"// R 是对返回结果的封装工具util\n" +
"// 返回结果：\n" +
@@ -14,28 +14,28 @@ const vul1ReflectRaw = "// 原生漏洞环境,未加任何过滤，Controller接
"// \"msg\": \"\",\n" +
"// \"code\": 0\n" +
"// }\n" +
- "// payload在json中是不会触发xss的 需要解析到页面中\n" +
+ "// JSON响应本身通常不会直接执行脚本；前端若把字段用innerHTML等方式写入页面，才会触发XSS\n" +
"\n" +
- "// 原生漏洞环境,未加任何过滤，Controller接口返回String类型结果\n" +
- "public String vul2(String content) {\n" +
- " return content;\n" +
+ "// 原生漏洞场景,未加任何过滤，Controller接口返回String类型结果\n" +
+ "public String vul2(String payload) {\n" +
+ " return payload;\n" +
"}"
const vul2ReflectContentType = "// Tomcat内置HttpServletResponse，Content-Type导致反射XSS\n" +
- "public void vul3(String type,String content, HttpServletResponse response) {\n" +
+ "public void vul3(String type,String payload, HttpServletResponse response) {\n" +
" switch (type) {\n" +
" case \"html\":\n" +
- " response.getWriter().print(content);\n" +
+ " response.getWriter().print(payload);\n" +
" response.setContentType(\"text/html;charset=utf-8\");\n" +
" response.getWriter().flush();\n" +
" break;\n" +
" case \"plain\":\n" +
- " response.getWriter().print(content);\n" +
+ " response.getWriter().print(payload);\n" +
" response.setContentType(\"text/plain;charset=utf-8\");\n" +
" response.getWriter().flush();\n" +
" ...\n" +
" }\n" +
"}"
-const safe1CheckUserInput = "// 对用户输入的数据进行验证和过滤，确保不包含恶意代码。使用白名单过滤，只允许特定类型的输入，如纯文本或指定格式的数据\n" +
+const safe1CheckUserInput = "// 使用白名单限制输入格式，适合约束字段类型；最终仍需根据输出位置进行上下文编码\n" +
"// 前端校验代码\n" +
"var whitelistRegex = /^[a-zA-Z0-9_\\s]+$/;\n" +
"\n" +
@@ -51,55 +51,56 @@ const safe1CheckUserInput = "// 对用户输入的数据进行验证和过滤，
"private static final String WHITELIST_REGEX = \"^[a-zA-Z0-9_\\\\s]+$\";\n" +
"private static final Pattern pattern = Pattern.compile(WHITELIST_REGEX);\n" +
"\n" +
- "Matcher matcher = pattern.matcher(content);\n" +
+ "Matcher matcher = pattern.matcher(payload);\n" +
"if (matcher.matches()){\n" +
- " return R.ok(content);\n" +
+ " return R.ok(payload);\n" +
"}else return R.error(\"输入内容包含非法字符，请检查输入\");"
-const safe2CSP = "// 内容安全策略（Content Security Policy）是一种由浏览器实施的安全机制，旨在减少和防范跨站脚本攻击（XSS）等安全威胁。它通过允许网站管理员定义哪些内容来源是可信任的，从而防止恶意内容的加载和执行\n" +
+const safe2CSP = "// 内容安全策略（Content Security Policy）是浏览器实施的额外防护层，可降低恶意脚本加载和执行风险，但不能替代输出编码与安全DOM/模板用法\n" +
"// 前端Meta配置\n" +
" "
-const safe1StoreEntityEscape = "// 表格数据渲染\n" +
+const safe1StoreEntityEscape = "// 表格数据渲染：数据库仍保存原始值，输出到HTML页面前按HTML正文文本编码\n" +
"table.render({\n" +
"\t...\n" +
" cols: [\n" +
@@ -151,10 +152,13 @@ const safe1StoreEntityEscape = "// 表格数据渲染\n" +
" return escapeHtml(d.ua); \n" +
" }},\n" +
" \t...\n" +
- "// 方法一、HTML 实体转义函数\n" +
+ "// 方法一、HTML正文输出编码函数\n" +
"function escapeHtml(html) {\n" +
+ " if (html === null || html === undefined) {\n" +
+ " return '';\n" +
+ " }\n" +
" var text = document.createElement(\"textarea\");\n" +
- " text.textContent = html;\n" +
+ " text.textContent = String(html);\n" +
" return text.innerHTML;\n" +
"}\n" +
"// 方法二、JavaScript的文本节点\n" +
@@ -163,31 +167,85 @@ const safe1StoreEntityEscape = "// 表格数据渲染\n" +
"// 方法三、jQuery的text()方法\n" +
"$('#element').text(htmlContent);\n"
-const vul1DomRaw = "// innerHTML\n" +
+const vul1DomRaw = "// 1. innerHTML XSS\n" +
"form.on('submit(vul1-dom-raw)', function (data) {\n" +
" var userInput = document.getElementById('vul1-dom-raw-input').value;\n" +
" var outputDiv = document.getElementById('vul-dom-raw-result');\n" +
- " outputDiv.innerHTML = userInput;\n" +
+ " outputDiv.innerHTML = userInput; // 漏洞点：直接使用innerHTML插入用户输入\n" +
+ " return false;\n" +
+ "});\n" +
+ "\n" +
+ "// 2. LocalStorage XSS\n" +
+ "form.on('submit(vul3-dom-raw-submit)', function (data) {\n" +
+ " localStorage.setItem('vul4-dom-raw', document.getElementById('vul4-dom-raw-input').value);\n" +
+ " var storedData = localStorage.getItem('vul4-dom-raw');\n" +
+ " document.getElementById('vul-dom-raw-result').innerHTML = storedData; // 漏洞点：从存储读取后直接插入\n" +
" return false;\n" +
"});\n" +
"\n" +
- "// href跳转场景\n" +
+ "// 3. href跳转XSS\n" +
"var hash = location.hash;\n" +
"if(hash){\n" +
- " var url = hash.substring(ueditor);\n" +
+ " var url = hash.substring(1); // 去掉#号\n" +
" console.log(url);\n" +
- " location.href = url;\n" +
+ " location.href = url; // 漏洞点：直接使用hash部分作为跳转URL\n" +
"}\n" +
"\n" +
- "// DOM存储注入\n" +
- "form.on('submit(vul3-dom-raw-submit)', function (data) {\n" +
- " localStorage.setItem('vul4-dom-raw', document.getElementById('vul4-dom-raw-input').value);\n" +
- " var storedData = localStorage.getItem('vul4-dom-raw');\n" +
- " document.getElementById('vul-dom-raw-result').innerHTML = storedData;\n" +
+ "// 4. Location对象XSS\n" +
+ "form.on('submit(location-xss)', function(data) {\n" +
+ " var payload = data.field.locationPayload;\n" +
+ " window.location = payload; // 漏洞点：直接使用用户输入修改location\n" +
" return false;\n" +
- "})"
+ "});\n" +
+ "\n" +
+ "// 5. Eval执行XSS\n" +
+ "form.on('submit(eval-xss)', function(data) {\n" +
+ " var payload = data.field.evalPayload;\n" +
+ " eval(payload); // 漏洞点：直接执行用户输入的JavaScript代码\n" +
+ " return false;\n" +
+ "});\n" +
+ "\n" +
+ "// 6. Document对象XSS\n" +
+ "form.on('submit(document-write)', function(data) {\n" +
+ " var payload = data.field.documentPayload;\n" +
+ " document.write(payload); // 漏洞点：直接写入用户输入的HTML\n" +
+ " document.close();\n" +
+ " return false;\n" +
+ "});\n" +
+ "form.on('submit(document-domain)', function(data) {\n" +
+ " var payload = data.field.documentPayload;\n" +
+ " document.domain = payload; // 风险点：直接修改document.domain会放宽同源边界或造成异常行为\n" +
+ " return false;\n" +
+ "});"
+
+const safeDomCode = "// 1. 普通文本输出：使用textContent，不解析HTML\n" +
+ "document.getElementById('safe-dom-result').textContent = userInput;\n" +
+ "\n" +
+ "// 2. URL跳转：校验协议白名单，拒绝javascript:、data:等危险协议\n" +
+ "var url = new URL(userInput, window.location.origin);\n" +
+ "var allowedProtocols = ['http:', 'https:'];\n" +
+ "if (allowedProtocols.indexOf(url.protocol) === -1) {\n" +
+ " throw new Error('dangerous protocol');\n" +
+ "}\n" +
+ "\n" +
+ "// 3. 替代eval：使用命令白名单映射，而不是执行用户输入\n" +
+ "var actions = {\n" +
+ " showTime: function () { return new Date().toLocaleString(); },\n" +
+ " showLocation: function () { return window.location.pathname; }\n" +
+ "};\n" +
+ "var action = actions[userInput];\n" +
+ "if (action) {\n" +
+ " action();\n" +
+ "}\n" +
+ "\n" +
+ "// 4. DOM API：创建文本节点，不拼接HTML字符串\n" +
+ "var node = document.createTextNode(userInput);\n" +
+ "element.appendChild(node);\n" +
+ "\n" +
+ "// 如果业务必须展示富文本，应先使用白名单HTML净化库处理后再渲染\n"
-const vul1OtherUpload = "public String uploadFile(MultipartFile file, String suffix,String path) throws IOException {\n" +
+const vul1OtherUpload = "// 上传可被浏览器或预览服务解析的HTML/SVG/XML/PDF等文件，后续访问文件时可能触发XSS或内容安全问题\n" +
+ "public String uploadFile(MultipartFile file, String suffix,String path) throws IOException {\n" +
" String uploadFolderPath = sysConstant.getUploadFolder();\n" +
" try {\n" +
" String fileName = +DateUtil.current() + \".\"+suffix;\n" +
@@ -203,11 +261,12 @@ const vul1OtherUpload = "public String uploadFile(MultipartFile file, String suf
" }\n" +
"}"
-const vul2OtherTemplate = "public String handleTemplateInjection(String content,String type, Model model) {\n" +
+const vul2OtherTemplate = "// th:utext会把内容作为HTML渲染；th:text会进行HTML转义\n" +
+ "public String handleTemplateInjection(String payload,String type, Model model) {\n" +
" if (\"html\".equals(type)) {\n" +
- " model.addAttribute(\"html\", content);\n" +
+ " model.addAttribute(\"html\", payload);\n" +
" } else if (\"text\".equals(type)) {\n" +
- " model.addAttribute(\"text\", content);\n" +
+ " model.addAttribute(\"text\", payload);\n" +
" }\n" +
" return \"vul/xss/other\";\n" +
"}\n" +
@@ -234,6 +293,22 @@ const vul3SCMSec = "// jQuery依赖\n" +
"\n" +
"// Ueditor编辑器未做任何限制 抓上传数据包后，可以上传任意类型文件";
+const vulHtml5 = "1、PostMessage XSS\n" +
+ "// 接收端：直接使用innerHTML插入消息\n" +
+ "window.addEventListener('message', function(event) {\n" +
+ " // 故意不验证origin\n" +
+ " document.getElementById('messageContainer').innerHTML = event.data;\n" +
+ "});\n" +
+ "2、WebSocket XSS\n" +
+ "// 客户端：直接使用innerHTML插入消息\n" +
+ "ws.onmessage = function(event) {\n" +
+ " document.getElementById('wsMessageContainer').innerHTML = event.data;\n" +
+ "};\n" +
+ "// 服务端：直接广播用户输入\n" +
+ "protected void handleTextMessage(WebSocketSession session, TextMessage message) throws Exception {\n" +
+ " broadcast(message.getPayload());\n" +
+ "}"
+
const vul1RawJoint = "// 原生sql语句动态拼接 参数未进行任何处理\n" +
"public R vul1(String type,String id,String username,String password) {\n" +
" //注册数据库驱动类\n" +
@@ -256,7 +331,7 @@ const vul1RawJoint = "// 原生sql语句动态拼接 参数未进行任何处理
" conn.close();\n" +
" return R.ok(message);\n" +
" case \"delete\":\n" +
- " sql = \"DELETE FROM users WHERE id = '\" + id + \"'\";\n" +
+ " sql = \"DELETE FROM sqli WHERE id = '\" + id + \"'\";\n" +
" rowsAffected = stmt.executeUpdate(sql);\n" +
" ...\n" +
" case \"update\":\n" +
@@ -264,7 +339,7 @@ const vul1RawJoint = "// 原生sql语句动态拼接 参数未进行任何处理
" rowsAffected = stmt.executeUpdate(sql);\n" +
" ...\n" +
" case \"select\":\n" +
- " sql = \"SELECT * FROM users WHERE id = \" + id;\n" +
+ " sql = \"SELECT * FROM sqli WHERE id = \" + id;\n" +
" ResultSet rs = stmt.executeQuery(sql);\n" +
" ...\n" +
" }\n" +
@@ -282,7 +357,7 @@ const vul2prepareStatementJoint = "// 虽然使用了conn.prepareStatement(sql)
" rowsAffected = stmt.executeUpdate(sql);\n" +
" ...\n" +
" case \"delete\":\n" +
- " sql = \"DELETE FROM users WHERE id = '\" + id + \"'\";\n" +
+ " sql = \"DELETE FROM sqli WHERE id = '\" + id + \"'\";\n" +
" stmt = conn.prepareStatement(sql);\n" +
" rowsAffected = stmt.executeUpdate(sql);\n" +
" ...\n" +
@@ -292,7 +367,7 @@ const vul2prepareStatementJoint = "// 虽然使用了conn.prepareStatement(sql)
" rowsAffected = stmt.executeUpdate(sql);\n" +
" ...\n" +
" case \"select\":\n" +
- " sql = \"SELECT * FROM users WHERE id = \" + id;\n" +
+ " sql = \"SELECT * FROM sqli WHERE id = \" + id;\n" +
" stmt = conn.prepareStatement(sql);\n" +
" ResultSet rs = stmt.executeQuery(sql);\n" +
" ...\n" +
@@ -313,7 +388,7 @@ const vul3JdbcTemplateJoint = "// JDBCTemplate是Spring对JDBC的封装，底层
" rowsAffected = jdbctemplate.update(sql);\n" +
" ...\n" +
" case \"delete\":\n" +
- " sql = \"DELETE FROM users WHERE id = '\" + id + \"'\";\n" +
+ " sql = \"DELETE FROM sqli WHERE id = '\" + id + \"'\";\n" +
" rowsAffected = jdbctemplate.update(sql);\n" +
" ...\n" +
" case \"update\":\n" +
@@ -321,8 +396,8 @@ const vul3JdbcTemplateJoint = "// JDBCTemplate是Spring对JDBC的封装，底层
" rowsAffected = jdbctemplate.update(sql);\n" +
" ...\n" +
" case \"select\":\n" +
- " sql = \"SELECT * FROM users WHERE id = \" + id;\n" +
- " stringObjectMap = jdbctemplate.queryForMap(sql);\n" +
+ " sql = \"SELECT * FROM sqli WHERE id = \" + id;\n" +
+ " resultList = jdbctemplate.queryForList(sql);\n" +
" ...\n" +
" }\n" +
"}"
@@ -334,17 +409,17 @@ const safe1PrepareStatementParametric = "// 采用预编译的方法，使用?
" switch (type) {\n" +
" case \"add\":\n" +
" // 这里可以看到使用了?占位符 sql语句和参数进行分离\n" +
- " sql = \"INSERT INTO users (username, password) VALUES (?, ?)\"; \n" +
+ " sql = \"INSERT INTO sqli (username, password) VALUES (?, ?)\"; \n" +
" stmt = conn.prepareStatement(sql);\n" +
" // 参数化处理\n" +
- " stmt.setString(ueditor, username); \n" +
+ " stmt.setString(1, username); \n" +
" stmt.setString(2, password);\n" +
" // 使用预编译时 不需要传递sql语句\n" +
" rowsAffected = stmt.executeUpdate();\n" +
" case \"delete\":\n" +
- " sql = \"DELETE FROM users WHERE id = ?\";\n" +
+ " sql = \"DELETE FROM sqli WHERE id = ?\";\n" +
" stmt = conn.prepareStatement(sql);\n" +
- " stmt.setString(ueditor, id);\n" +
+ " stmt.setString(1, id);\n" +
" rowsAffected = stmt.executeUpdate();\n" +
" ...\n" +
" case \"update\":\n" +
@@ -353,12 +428,12 @@ const safe1PrepareStatementParametric = "// 采用预编译的方法，使用?
" stmt.setString(1, username); \n" +
" stmt.setString(2, password);\n" +
" stmt.setString(3, id);\n" +
- " stmt.executeUpdate();\n" +
+ " rowsAffected = stmt.executeUpdate();\n" +
" ...\n" +
" case \"select\":\n" +
- " sql = \"SELECT * FROM users WHERE id = ?\";\n" +
+ " sql = \"SELECT * FROM sqli WHERE id = ?\";\n" +
" stmt = conn.prepareStatement(sql);\n" +
- " stmt.setString(ueditor, id);\n" +
+ " stmt.setString(1, id);\n" +
" ResultSet rs = stmt.executeQuery();\n" +
" ...\n" +
" }\n" +
@@ -377,20 +452,21 @@ const safe2JdbcTemplatePrepareStatementParametric = "// JDBCTemplate预编译
" rowsAffected = jdbctemplate.update(sql, username, password);\n" +
" ...\n" +
" case \"delete\":\n" +
- " sql = \"DELETE FROM users WHERE id = ?\";\n" +
+ " sql = \"DELETE FROM sqli WHERE id = ?\";\n" +
" rowsAffected = jdbctemplate.update(sql, id);\n" +
" ...\n" +
" case \"update\":\n" +
" sql = \"UPDATE sqli SET username = ?, password = ? WHERE id = ?\";\n" +
- " rowsAffected = jdbctemplate.update(sql, username, id);\n" +
+ " rowsAffected = jdbctemplate.update(sql, username, password, id);\n" +
" ...\n" +
" case \"select\":\n" +
- " sql = \"SELECT * FROM users WHERE id = ?\";\n" +
+ " sql = \"SELECT * FROM sqli WHERE id = ?\";\n" +
" stringObjectMap = jdbctemplate.queryForMap(sql, id);\n" +
" ...\n" +
" }\n" +
"}\n"
-const safe3BlacklistcheckSqlBlackList = "// 检测用户输入是否存在敏感字符：'、;、--、+、,、%、=、>、<、*、(、)、and、or、exeinsert、select、delete、update、count、drop、chr、midmaster、truncate、char、declare\n" +
+const safe3BlacklistcheckSqlBlackList = "// 黑名单只能作为辅助检测或拦截，不应替代参数化查询。\n" +
+ "// 遗漏关键字、编码绕过、语法变形都可能导致绕过。\n" +
"public R safe3(String type,String id,String username,String password) {\n" +
" Class.forName(\"com.mysql.cj.jdbc.Driver\");\n" +
" Connection conn = DriverManager.getConnection(dbUrl, dbUser, dbPass);\n" +
@@ -400,28 +476,28 @@ const safe3BlacklistcheckSqlBlackList = "// 检测用户输入是否存在敏感
" if (checkUserInput.checkSqlBlackList(username) || checkUserInput.checkSqlBlackList(password)) {\n" +
" return R.error(\"黑名单检测到非法SQL注入!\");\n" +
" } else {\n" +
- " sql = \"INSERT INTO users (username, password) VALUES ('\" + username + \"', '\" + password + \"')\";\n" +
+ " sql = \"INSERT INTO sqli (username, password) VALUES ('\" + username + \"', '\" + password + \"')\";\n" +
" rowsAffected = stmt.executeUpdate(sql);\n" +
" ...\n" +
" case \"delete\":\n" +
" if (checkUserInput.checkSqlBlackList(id)) {\n" +
" return R.error(\"黑名单检测到非法SQL注入!\");\n" +
" } else {\n" +
- " sql = \"DELETE FROM users WHERE id = '\" + id + \"'\";\n" +
+ " sql = \"DELETE FROM sqli WHERE id = '\" + id + \"'\";\n" +
" rowsAffected = stmt.executeUpdate(sql);\n" +
" ...\n" +
" case \"update\":\n" +
- " if (checkUserInput.checkSqlBlackList(id) || checkUserInput.checkSqlBlackList(username) || checkUserInput.checkSqlBlackList(id)) {\n" +
+ " if (checkUserInput.checkSqlBlackList(id) || checkUserInput.checkSqlBlackList(username) || checkUserInput.checkSqlBlackList(password)) {\n" +
" return R.error(\"黑名单检测到非法SQL注入!\");\n" +
" } else {\n" +
- " sql = \"UPDATE users SET password = '\" + password + \"', username = '\" + username + \"' WHERE id = '\" + id + \"'\";\n" +
+ " sql = \"UPDATE sqli SET password = '\" + password + \"', username = '\" + username + \"' WHERE id = '\" + id + \"'\";\n" +
" rowsAffected = stmt.executeUpdate(sql);\n" +
" ...\n" +
" case \"select\":\n" +
" if (checkUserInput.checkSqlBlackList(id)) {\n" +
" return R.error(\"黑名单检测到非法SQL注入!\");\n" +
" } else {\n" +
- " sql = \"SELECT * FROM users WHERE id = \" + id;\n" +
+ " sql = \"SELECT * FROM sqli WHERE id = \" + id;\n" +
" ResultSet rs = stmt.executeQuery(sql);\n" +
" ...\n" +
" }\n" +
@@ -433,46 +509,47 @@ const safe4RequestRarameterValidate = "// 强制类型转换 对用户请求参
" Statement stmt = conn.createStatement();\n" +
" message = checkUserInput.checkUser(id);\n" +
" if (!message.isEmpty()) return R.error(message);\n" +
- " sql = \"SELECT * FROM users WHERE id = \" + id;\n" +
+ " sql = \"SELECT * FROM sqli WHERE id = \" + id;\n" +
" ResultSet rs = stmt.executeQuery(sql);\n" +
" ...\n" +
"}"
-const safe4EASAPIFilter = "// ESAPI提供了多种输入验证API，提供对XSS攻击和SQL注入攻击等的防护\n" +
- "public R safe4(String id) {\n" +
+const safe4EASAPIFilter = "// encodeForSQL是历史方案或特定数据库Codec场景下的补充手段，不推荐作为首选修复。\n" +
+ "// SQL注入首选修复仍然是参数化查询。\n" +
+ "public R safe5(String id) {\n" +
" Codec oracleCodec = new OracleCodec();\n" +
" Class.forName(\"com.mysql.cj.jdbc.Driver\");\n" +
" Connection conn = DriverManager.getConnection(dbUrl, dbUser, dbPass);\n" +
"\n" +
" Statement stmt = conn.createStatement();\n" +
- " // 使用了 Oracle 的编解码器 OracleCodec 和 ESAPI 库来对 ID 进行编码，以防止 SQL 注入攻击。\n" +
+ " // 使用OracleCodec对ID进行SQL编码，仅作为特定场景补充。\n" +
" String sql = \"select * from sqli where id = '\" + ESAPI.encoder().encodeForSQL(oracleCodec, id) + \"'\";\n" +
" // String sql = \"select * from sqli where id = '\" + id + \"'\";\n" +
- " String sql = \"select * from users where id = '\" + id + \"'\";\n" +
" ResultSet rs = stmt.executeQuery(sql);\n" +
"}"
-const special1OrderBy = "// ORDER BY关键字用于按升序或降序对结果集进行排序。 由于order by后面需要紧跟column_name，而预编译是参数化字符串，而order by后面紧跟字符串就会不支持原有功能 使用默认排序，因此通常防御order by注入需要使用白名单的方式\n" +
+const special1OrderBy = "// 占位符只能绑定“值”，不能绑定列名、表名、关键字、排序方向等SQL结构。\n" +
+ "// ORDER BY动态字段应使用枚举映射或白名单。\n" +
"public R special1OrderBy(String type,String field) {\n" +
" Class.forName(\"com.mysql.cj.jdbc.Driver\");\n" +
" Connection conn = DriverManager.getConnection(dbUrl, dbUser, dbPass);\n" +
" PreparedStatement preparedStatement;\n" +
" switch (type) {\n" +
" case \"raw\":\n" +
- " sql = \"SELECT * FROM users ORDER BY \" + field;\n" +
+ " sql = \"SELECT * FROM sqli ORDER BY \" + field;\n" +
" preparedStatement = conn.prepareStatement(sql);\n" +
" rs = preparedStatement.executeQuery();\n" +
" ...\n" +
" case \"prepareStatement\":\n" +
- " // 可以测试下 预编译没有报错 不过插入语句不生效 默认使用主键升序\n" +
- " sql = \"select * from users order by ?\";\n" +
+ " // ORDER BY ? 会把字段名当作普通值或表达式处理，不会按传入字段排序。\n" +
+ " sql = \"select * from sqli order by ?\";\n" +
" preparedStatement = conn.prepareStatement(sql);\n" +
- " preparedStatement.setString(ueditor, field);\n" +
+ " preparedStatement.setString(1, field);\n" +
" rs = preparedStatement.executeQuery();\n" +
" ...\n" +
" case \"writeList\":\n" +
- " sql = \"SELECT * FROM users ORDER BY \" + field;\n" +
- " if (checkUserInput.chechSqlWhiteList(field)) {\n" +
+ " if (!checkUserInput.checkSqlWhiteList(field)) {\n" +
" return R.error(\"field字段不合法！\");\n" +
" }\n" +
+ " sql = \"SELECT * FROM sqli ORDER BY \" + field;\n" +
" preparedStatement = conn.prepareStatement(sql);\n" +
" rs = preparedStatement.executeQuery();\n" +
" }\n" +
@@ -520,11 +597,52 @@ const special3Limit = "public R special3Limit(String type,String size) {\n" +
" case \"prepareStatement\":\n" +
" sql = \"SELECT * FROM sqli ORDER BY id DESC LIMIT ?\";\n" +
" preparedStatement = conn.prepareStatement(sql);\n" +
- " preparedStatement.setString(1, size);\n" +
+ " preparedStatement.setInt(1, Integer.parseInt(size));\n" +
" rs = preparedStatement.executeQuery();\n" +
" ...\n" +
" }\n" +
"}"
+const special4SecondOrder = "// 第一步：参数化写入恶意数据，此时不触发SQL注入。\n" +
+ "public R special4SecondOrder(String type,String id,String username,String password) {\n" +
+ " switch (type) {\n" +
+ " case \"store\":\n" +
+ " String insertSql = \"INSERT INTO sqli (username, password) VALUES (?, ?)\";\n" +
+ " PreparedStatement ps = conn.prepareStatement(insertSql, Statement.RETURN_GENERATED_KEYS);\n" +
+ " ps.setString(1, username);\n" +
+ " ps.setString(2, password);\n" +
+ " ps.executeUpdate();\n" +
+ " ...\n" +
+ " case \"trigger\":\n" +
+ " // 第二步：先通过ID取出已存储的username。\n" +
+ " String storedUsername = queryUsernameById(id);\n" +
+ " // 漏洞点：数据库中的历史数据再次被拼接进SQL结构。\n" +
+ " String vulSql = \"SELECT id, username, password FROM sqli WHERE username = '\" + storedUsername + \"'\";\n" +
+ " ResultSet rs = stmt.executeQuery(vulSql);\n" +
+ " ...\n" +
+ " case \"safeTrigger\":\n" +
+ " String safeSql = \"SELECT id, username, password FROM sqli WHERE username = ?\";\n" +
+ " PreparedStatement safePs = conn.prepareStatement(safeSql);\n" +
+ " safePs.setString(1, storedUsername);\n" +
+ " ResultSet safeRs = safePs.executeQuery();\n" +
+ " ...\n" +
+ " }\n" +
+ "}\n"
+const special5Union = "// UNION回显要求原查询与联合查询列数一致、类型兼容。\n" +
+ "public R special5Union(String type,String id) {\n" +
+ " switch (type) {\n" +
+ " case \"raw\":\n" +
+ " String sql = \"SELECT id, username, password FROM sqli WHERE id = \" + id;\n" +
+ " // 示例：id = -1 UNION SELECT 1,database(),user()\n" +
+ " ResultSet rs = stmt.executeQuery(sql);\n" +
+ " ...\n" +
+ " case \"prepareStatement\":\n" +
+ " String safeSql = \"SELECT id, username, password FROM sqli WHERE id = ?\";\n" +
+ " PreparedStatement ps = conn.prepareStatement(safeSql);\n" +
+ " ps.setString(1, id);\n" +
+ " ResultSet safeRs = ps.executeQuery();\n" +
+ " ...\n" +
+ " }\n" +
+ "}\n"
// MyBatis
const vul1CustomMethod = "vul1CustomMethod"
@@ -582,6 +700,9 @@ const mybatisSpecial1OrderBy =
" sqlis = sqliService.orderByPrepareStatement(field);\n" +
" break;\n" +
" case \"writeList\":\n" +
+ " if (!checkUserInput.checkSqlWhiteList(field)) {\n" +
+ " return R.error(\"field字段不合法！\");\n" +
+ " }\n" +
" sqlis = sqliService.orderByWriteList(field);\n" +
" ...\n" +
"// Service层\n" +
@@ -599,21 +720,21 @@ const mybatisSpecial1OrderBy =
" return sqliMapper.orderByWriteList(field);\n" +
"}\n" +
"// Mapper层\n" +
- "\n" +
+ "\n" +
"\n" +
" SELECT * FROM sqli\n" +
" \n" +
" ORDER BY ${field}\n" +
" \n" +
" \n" +
- "\n" +
+ "\n" +
"\n" +
" SELECT * FROM sqli\n" +
" \n" +
" ORDER BY #{field}\n" +
" \n" +
" \n" +
- "\n" +
+ "\n" +
"\n" +
" SELECT * FROM sqli\n" +
" \n" +
@@ -630,7 +751,7 @@ const mybatisSpecial1OrderBy =
" \n" +
" "
-const mybatisSpecial2Like ="// Controller层\n" +
+const mybatisSpecial2Like = "// Controller层\n" +
"public R special1OrderBy() {\n" +
"@PostMapping(\"/special2-Like\")\n" +
"public R special2Like(String type,String keyword) {\n" +
@@ -661,7 +782,7 @@ const mybatisSpecial2Like ="// Controller层\n" +
" SELECT * FROM sqli WHERE username LIKE CONCAT('%', #{keyword}, '%')\n" +
""
-const mybatisSpecial3In ="// Controller层\n" +
+const mybatisSpecial3In = "// Controller层\n" +
"public R special3In(String type,String scope) {\n" +
" switch (type) {\n" +
" case \"raw\":\n" +
@@ -671,8 +792,11 @@ const mybatisSpecial3In ="// Controller层\n" +
" sqlis = sqliService.inPrepareStatement(scope);\n" +
" break;\n" +
" case \"Foreach\":\n" +
- "\n" +
- " sqlis = sqliService.inSafeForeach(parseInputToList(scope));\n" +
+ " List idList = parseInputToList(scope);\n" +
+ " if (idList.isEmpty()) {\n" +
+ " return R.error(\"scope中没有合法整数ID!\");\n" +
+ " }\n" +
+ " sqlis = sqliService.inSafeForeach(idList);\n" +
" break;\n" +
" ...\n" +
"// Service层\n" +
@@ -712,7 +836,7 @@ const safeJPA = "safeJPA"
// 任意文件类-文件上传
-const anyFileUploadCode = "// 原生漏洞环境，未做任何限制\n" +
+const anyFileUploadCode = "// 原生漏洞场景，未做任何限制\n" +
"public R vul(MultipartFile file, HttpServletRequest request) {\n" +
" String res;\n" +
" String suffix = FilenameUtils.getExtension(\n" +
@@ -724,18 +848,153 @@ const anyFileUploadCode = "// 原生漏洞环境，未做任何限制\n" +
"}\n" +
"// uploadFile方法详见文件上传导致XSS模块\n"
const anyFileUploadWhiteCode = "// 检测文件后缀，做白名单过滤\n" +
+ "String suffix = FilenameUtils.getExtension(file.getOriginalFilename());\n" +
"if (!checkUserInput.checkFileSuffixWhiteList(suffix)){\n" +
" return R.error(\"只能上传图片哦！\");\n" +
"}\n" +
+ "if (!isAllowedImageContent(file, suffix)) {\n" +
+ " return R.error(\"文件内容与图片类型不匹配！\");\n" +
+ "}\n" +
"\n" +
"public boolean checkFileSuffixWhiteList(String suffix) {\n" +
+ " if (suffix == null || suffix.isEmpty()) {\n" +
+ " return false;\n" +
+ " }\n" +
" String[] white_list = {\"jpg\", \"png\", \"gif\",\"jpeg\",\"bmp\",\"ico\"};\n" +
" for (String s : white_list) {\n" +
- " if (suffix.toLowerCase().contains(s)) {\n" +
+ " if (suffix.equalsIgnoreCase(s)) {\n" +
" return true;\n" +
" }\n" +
" }\n" +
" return false;\n" +
+ "}\n" +
+ "\n" +
+ "private boolean isAllowedImageContent(MultipartFile file, String suffix) throws IOException {\n" +
+ " if (\"ico\".equalsIgnoreCase(suffix)) {\n" +
+ " // 校验 ICO 文件头：00 00 01 00\n" +
+ " }\n" +
+ " BufferedImage image = ImageIO.read(file.getInputStream());\n" +
+ " return image != null;\n" +
+ " // ImageIO 解析异常时返回 false，避免损坏图片导致 500\n" +
+ "}"
+
+const vul1Native = "public R vul1(@RequestParam String username) {\n" +
+ " try {\n" +
+ " String sql = \"SELECT * FROM sqli WHERE username = '\" + username + \"'\";\n" +
+ " Object[] result = (Object[]) hibernateTemplate.execute(session ->\n" +
+ " session.createNativeQuery(sql).uniqueResult()\n" +
+ " );\n" +
+ " message = \"查询成功，用户名：\" + result[1] + \" 密码：\" +result[2];\n" +
+ " return R.ok(message);\n" +
+ " } catch (Exception e) {\n" +
+ " log.error(\"查询失败\", e);\n" +
+ " return R.error(e.getMessage());\n" +
+ " }\n" +
+ "}"
+const vul2Hql = "public R vul2(@RequestParam String username) {\n" +
+ " try {\n" +
+ " String hql = \"FROM Sqli WHERE username = '\" + username + \"'\";\n" +
+ " Sqli result = (Sqli) hibernateTemplate.execute(session ->\n" +
+ " session.createQuery(hql).uniqueResult()\n" +
+ " );\n" +
+ " message = \"查询成功，用户名：\" +result.getUsername()+ \" 密码：\" +result.getPassword();\n" +
+ " return R.ok(message);\n" +
+ " } catch (Exception e) {\n" +
+ " log.error(\"查询失败\", e);\n" +
+ " return R.error(e.getMessage());\n" +
+ " }\n" +
+ "}"
+const safe1Param = "public R safe(@RequestParam String username) {\n" +
+ " try {\n" +
+ " String hql = \"FROM Sqli WHERE username = :username\";\n" +
+ " Sqli result = hibernateTemplate.execute(session ->\n" +
+ " (Sqli) session.createQuery(hql)\n" +
+ " .setParameter(\"username\", username)\n" +
+ " .uniqueResult()\n" +
+ " );\n" +
+ " message = \"查询成功，用户名：\" +result.getUsername()+ \" 密码：\" +result.getPassword();\n" +
+ " return R.ok(message);\n" +
+ " } catch (Exception e) {\n" +
+ " log.error(\"查询失败\", e);\n" +
+ " return R.error(e.getMessage());\n" +
+ " }\n" +
+ "}"
+
+const vul1JpaJpql = "public R vul1(@RequestParam String username) {\n" +
+ " try {\n" +
+ " String jpql = \"SELECT s FROM Sqli s WHERE s.username = '\" + username + \"'\";\n" +
+ " Query query = entityManager.createQuery(jpql);\n" +
+ " List results = query.getResultList();\n" +
+ " if (results == null || results.isEmpty()) {\n" +
+ " return R.error(\"未找到记录\");\n" +
+ " }\n" +
+ " StringBuilder sb = new StringBuilder();\n" +
+ " sb.append(\"查询成功，找到 \").append(results.size()).append(\" 条记录\\n\");\n" +
+ " message = sb.toString();\n" +
+ " log.info(message);\n" +
+ " return R.ok(message);\n" +
+ " } catch (Exception e) {\n" +
+ " String errorMsg = e.getMessage();\n" +
+ " log.error(\"查询失败: {}\", errorMsg, e);\n" +
+ " return R.error(errorMsg);\n" +
+ " }\n" +
+ "}"
+const vul2JpaSort = "public R vul2(@RequestParam String orderBy) {\n" +
+ " try {\n" +
+ " String jpql = \"SELECT s FROM Sqli s ORDER BY s.\" + orderBy;\n" +
+ " Query query = entityManager.createQuery(jpql);\n" +
+ " List results = query.getResultList();\n" +
+ " return R.ok(formatResults(results));\n" +
+ " } catch (Exception e) {\n" +
+ " String errorMsg = e.getMessage();\n" +
+ " log.error(\"查询失败: {}\", errorMsg, e);\n" +
+ " return R.error(errorMsg);\n" +
+ " }\n" +
+ "}"
+const safeJpaParam = "public R safe(@RequestParam String username) {\n" +
+ " try {\n" +
+ " String jpql = \"SELECT s FROM Sqli s WHERE s.username = :username\";\n" +
+ " Query query = entityManager.createQuery(jpql)\n" +
+ " .setParameter(\"username\", username);\n" +
+ " List results = query.getResultList();\n" +
+ " if (results == null || results.isEmpty()) {\n" +
+ " return R.error(\"未找到记录\");\n" +
+ " }\n" +
+ " StringBuilder sb = new StringBuilder();\n" +
+ " sb.append(\"查询成功，找到 \").append(results.size()).append(\" 条记录\\n\");\n" +
+ " message = sb.toString();\n" +
+ " log.info(message);\n" +
+ " return R.ok(message);\n" +
+ " } catch (Exception e) {\n" +
+ " String errorMsg = e.getMessage();\n" +
+ " log.error(\"查询失败: {}\", errorMsg, e);\n" +
+ " return R.error(errorMsg);\n" +
+ " }\n" +
+ "}"
+const safeJpaSort = "public R safeOrder(@RequestParam String orderBy) {\n" +
+ " try {\n" +
+ " Map orderByMap = new HashMap<>();\n" +
+ " orderByMap.put(\"id\", \"id\");\n" +
+ " orderByMap.put(\"username\", \"username\");\n" +
+ " orderByMap.put(\"password\", \"password\");\n" +
+ "\n" +
+ " String safeOrderBy = orderByMap.get(orderBy);\n" +
+ " if (safeOrderBy == null) {\n" +
+ " return R.error(\"排序字段不合法\");\n" +
+ " }\n" +
+ "\n" +
+ " CriteriaBuilder cb = entityManager.getCriteriaBuilder();\n" +
+ " CriteriaQuery cq = cb.createQuery(Sqli.class);\n" +
+ " Root root = cq.from(Sqli.class);\n" +
+ " cq.select(root).orderBy(cb.asc(root.get(safeOrderBy)));\n" +
+ "\n" +
+ " List results = entityManager.createQuery(cq).getResultList();\n" +
+ " return R.ok(formatResults(results));\n" +
+ " } catch (Exception e) {\n" +
+ " String errorMsg = e.getMessage();\n" +
+ " log.error(\"查询失败: {}\", errorMsg, e);\n" +
+ " return R.error(errorMsg);\n" +
+ " }\n" +
"}"
// 任意文件类型-文件删除
@@ -753,12 +1012,19 @@ const deleteFile = "public String vul(String filePath) {\n" +
" }\n" +
"}"
const safeDeleteFile = "public String safe(String fileName) {\n" +
- " // 限制删除文件所在目录为 /static/upload/下\n" +
- " String baseDir = sysConstant.getUploadFolder(); \n" +
- " File file = new File(baseDir, fileName);\n" +
+ " String baseDir = sysConstant.getUploadFolder();\n" +
+ " Path basePath = Paths.get(baseDir).toRealPath();\n" +
+ " Path filePath = basePath.resolve(fileName).normalize();\n" +
+ " if (!filePath.startsWith(basePath)) {\n" +
+ " return \"访问被拒绝：文件路径不合法\";\n" +
+ " }\n" +
" boolean deleted = false;\n" +
- " if (file.exists() && file.getCanonicalPath().startsWith(new File(baseDir).getCanonicalPath())) {\n" +
- " deleted = file.delete();\n" +
+ " if (Files.isRegularFile(filePath)) {\n" +
+ " Path realFilePath = filePath.toRealPath();\n" +
+ " if (!realFilePath.startsWith(basePath)) {\n" +
+ " return \"访问被拒绝：文件真实路径不合法\";\n" +
+ " }\n" +
+ " deleted = Files.deleteIfExists(filePath);\n" +
" }\n" +
" if (deleted) {\n" +
" return \"文件删除成功: \" + fileName;\n" +
@@ -775,7 +1041,7 @@ const readFile = "public String vul(String fileName) throws IOException {\n" +
" if (file.exists() && file.isFile()) {\n" +
" Path filePath = file.toPath();\n" +
" // 使用 BufferedReader 和流 API 逐行读取文件\n" +
- " try (var lines = Files.lines(filePath)) {\n" +
+ " try (Stream lines = Files.lines(filePath)) {\n" +
" return lines\n" +
" .map(line -> line + \" urlList = new ArrayList<>(Arrays.asList(\"baidu.com\", \"www.baidu.com\", \"whgojp.top\"));\n" +
" try {\n" +
- " URI uri = new URI(url.toLowerCase());\n" +
+ " URI uri = new URI(url);\n" +
" String host = uri.getHost();\n" +
- " return urlList.contains(host);\n" +
- " } catch (URISyntaxException e) {\n" +
+ " if (host == null || uri.getUserInfo() != null) {\n" +
+ " return false;\n" +
+ " }\n" +
+ " return urlList.contains(host.toLowerCase(Locale.ROOT)) && !isInternalHost(host);\n" +
+ " } catch (URISyntaxException | UnknownHostException e) {\n" +
" System.out.println(e);\n" +
" return false;\n" +
" }\n" +
+ "}\n" +
+ "\n" +
+ "private boolean isInternalHost(String host) throws UnknownHostException {\n" +
+ " InetAddress[] addresses = InetAddress.getAllByName(host);\n" +
+ " for (InetAddress address : addresses) {\n" +
+ " if (address.isAnyLocalAddress()\n" +
+ " || address.isLoopbackAddress()\n" +
+ " || address.isLinkLocalAddress()\n" +
+ " || address.isSiteLocalAddress()\n" +
+ " || address.isMulticastAddress()) {\n" +
+ " return true;\n" +
+ " }\n" +
+ " }\n" +
+ " return false;\n" +
"}"
// RCE
@@ -928,13 +1243,33 @@ const vulProcessImpl = "public R vul3(String payload) throws Exception {\n" +
" return R.ok(output.toString());\n" +
" }\n" +
"}"
-const safeProcessBuilder = "// 验证命令是否在允许的列表中\n" +
- "if (!ALLOWED_COMMANDS.contains(payload)) {\n" +
- " return R.error(\"不允许执行该命令！\");\n" +
+const safeProcessBuilder = "// 业务动作到固定命令参数的映射，用户不能直接控制命令字符串\n" +
+ "private static final Map> ALLOWED_COMMANDS = new HashMap<>();\n" +
+ "static {\n" +
+ " ALLOWED_COMMANDS.put(\"list\", Arrays.asList(\"ls\"));\n" +
+ " ALLOWED_COMMANDS.put(\"date\", Arrays.asList(\"date\"));\n" +
"}\n" +
"\n" +
- "// 可执行命令白名单\n" +
- "private static final List ALLOWED_COMMANDS = Arrays.asList(\"ls\", \"date\");"
+ "public R safe(String payload) throws IOException {\n" +
+ " List command = ALLOWED_COMMANDS.get(payload);\n" +
+ " if (command == null) {\n" +
+ " return R.error(\"不允许执行该动作！\");\n" +
+ " }\n" +
+ " ProcessBuilder pb = new ProcessBuilder(command);\n" +
+ " pb.redirectErrorStream(true);\n" +
+ " Process process = pb.start();\n" +
+ " try {\n" +
+ " if (!process.waitFor(3, TimeUnit.SECONDS)) {\n" +
+ " process.destroyForcibly();\n" +
+ " return R.error(\"命令执行超时！\");\n" +
+ " }\n" +
+ " } catch (InterruptedException e) {\n" +
+ " Thread.currentThread().interrupt();\n" +
+ " return R.error(\"命令执行被中断！\");\n" +
+ " }\n" +
+ " String output = readProcessOutput(process);\n" +
+ " return R.ok(output);\n" +
+ "}"
const vulGroovy = "public R vulGroovy(String payload) {\n" +
" try {\n" +
@@ -964,30 +1299,16 @@ const vulGroovy = "public R vulGroovy(String payload) {\n" +
" return output.toString();\n" +
"}"
const safeGroovy = 'public R safeGroovy(String payload) {\n' +
- ' List trustedScripts = Arrays.asList(\n' +
- ' "\\"id\\".execute()",\n' +
- ' "\\"ls\\".execute()",\n' +
- ' "\\"whoami\\".execute()"\n' +
- ' );\n' +
- ' if (!isTrustedScript(payload, trustedScripts)) {\n' +
- ' return R.error("非法的脚本输入！");\n' +
+ ' if ("hello".equals(payload)) {\n' +
+ ' return R.ok("[+] 受控动作执行结果：Hello JavaSecLab");\n' +
' }\n' +
- ' try {\n' +
- ' GroovyShell shell = new GroovyShell();\n' +
- ' Object result = shell.evaluate(payload); \n' +
- ' if (result instanceof Process) {\n' +
- ' Process process = (Process) result;\n' +
- ' String output = getProcessOutput(process);\n' +
- ' return R.ok("[+] 执行受信任的脚本，结果：" + output);\n' +
- ' } else {\n' +
- ' return R.ok("[+] 执行受信任的脚本，结果：" + result.toString());\n' +
- ' }\n' +
- ' } catch (Exception e) {\n' +
- ' return R.error(e.getMessage());\n' +
+ ' if ("time".equals(payload)) {\n' +
+ ' return R.ok("[+] 受控动作执行结果：" + LocalDateTime.now().format(DateTimeFormatter.ISO_LOCAL_DATE_TIME));\n' +
' }\n' +
- '}\n' +
- 'private boolean isTrustedScript(String script, List trustedScripts) {\n' +
- ' return trustedScripts.contains(script);\n' +
+ ' if ("sum".equals(payload)) {\n' +
+ ' return R.ok("[+] 受控动作执行结果：" + (1 + 2 + 3));\n' +
+ ' }\n' +
+ ' return R.error("非法的动作输入！");\n' +
'}'
// XXE
@@ -1026,6 +1347,17 @@ const vulSAXParser = "public String vul2(String payload) {\n" +
" }\n" +
"}"
+const vulDocumentBuilder = "public String vul3(String payload) {\n" +
+ " try {\n" +
+ " DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();\n" +
+ " DocumentBuilder builder = factory.newDocumentBuilder();\n" +
+ " Document document = builder.parse(new InputSource(new StringReader(payload)));\n" +
+ " return document.getDocumentElement().getTextContent();\n" +
+ " } catch (Exception e) {\n" +
+ " return e.toString();\n" +
+ " }\n" +
+ "}"
+
const safeXMLReader = "public String safe1(String payload) {\n" +
" try {\n" +
" XMLReader xmlReader = XMLReaderFactory.createXMLReader();\n" +
@@ -1033,6 +1365,8 @@ const safeXMLReader = "public String safe1(String payload) {\n" +
" xmlReader.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n" +
" xmlReader.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n" +
" xmlReader.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n" +
+ " xmlReader.setFeature(\"http://apache.org/xml/features/nonvalidating/load-external-dtd\", false);\n" +
+ " xmlReader.setEntityResolver((publicId, systemId) -> new InputSource(new StringReader(\"\")));\n" +
" ...\n" +
" xmlReader.parse(new InputSource(new StringReader(payload)));\n" +
" return stringWriter.toString();\n" +
@@ -1040,7 +1374,32 @@ const safeXMLReader = "public String safe1(String payload) {\n" +
" return e.getMessage();\n" +
" }\n" +
"}"
-const safeBlackList = "public String safe2(String payload) {\n" +
+const safeDocumentBuilder = "public String safe3(String payload) {\n" +
+ " try {\n" +
+ " DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();\n" +
+ " factory.setFeature(\"http://apache.org/xml/features/disallow-doctype-decl\", true);\n" +
+ " factory.setFeature(\"http://xml.org/sax/features/external-general-entities\", false);\n" +
+ " factory.setFeature(\"http://xml.org/sax/features/external-parameter-entities\", false);\n" +
+ " factory.setFeature(\"http://apache.org/xml/features/nonvalidating/load-external-dtd\", false);\n" +
+ " factory.setXIncludeAware(false);\n" +
+ " factory.setExpandEntityReferences(false);\n" +
+ " setAttributeIfSupported(factory, XMLConstants.ACCESS_EXTERNAL_DTD, \"\");\n" +
+ " setAttributeIfSupported(factory, XMLConstants.ACCESS_EXTERNAL_SCHEMA, \"\");\n" +
+ " DocumentBuilder builder = factory.newDocumentBuilder();\n" +
+ " builder.setEntityResolver((publicId, systemId) -> new InputSource(new StringReader(\"\")));\n" +
+ " ...\n" +
+ " } catch (Exception e) {\n" +
+ " return e.toString();\n" +
+ " }\n" +
+ "}\n" +
+ "private void setAttributeIfSupported(DocumentBuilderFactory factory, String name, String value) {\n" +
+ " try {\n" +
+ " factory.setAttribute(name, value);\n" +
+ " } catch (IllegalArgumentException ignored) {\n" +
+ " }\n" +
+ "}"
+const safeBlackList = "// 黑名单只能作为辅助检测，不应替代解析器安全配置\n" +
+ "public String safe2(String payload) {\n" +
" String[] black_list = {\"ENTITY\", \"DOCTYPE\"};\n" +
" for (String keyword : black_list) {\n" +
" if (payload.toUpperCase().contains(keyword)) {\n" +
@@ -1052,18 +1411,119 @@ const safeBlackList = "public String safe2(String payload) {\n" +
// 漏洞漏洞
+// 验证码安全
+const vul1Graphic = "public Boolean verifyCaptcha(String captchaInput, HttpSession session) {\n" +
+ " String sessionCaptcha = (String) session.getAttribute(\"vulCaptcha\");\n" +
+ " Long captchaCreationTime = (Long) session.getAttribute(\"captchaCreationTime\");\n" +
+ " // 如果没有验证码或生成时间，返回失败\n" +
+ " if (sessionCaptcha == null || captchaCreationTime == null) {\n" +
+ " return false;\n" +
+ " }\n" +
+ " // 验证码有效期为300秒（5分钟）5分钟可以无限制爆破账号密码\n" +
+ " long captchaExpiryTime = 300 * 1000; // 300秒转换为毫秒\n" +
+ " // 检查验证码是否过期\n" +
+ " if (System.currentTimeMillis() - captchaCreationTime > captchaExpiryTime) {\n" +
+ " session.removeAttribute(\"vulCaptcha\");\n" +
+ " session.removeAttribute(\"captchaCreationTime\");\n" +
+ " return false;\n" +
+ " }\n" +
+ " // 验证输入的验证码 这里验证失败后也没有清除旧的验证码\n" +
+ " if (sessionCaptcha.equalsIgnoreCase(captchaInput)) {\n" +
+ " return true;\n" +
+ " } else {\n" +
+ " return false;\n" +
+ " }\n" +
+ "}"
+const vul2Graphic = "public R vul2(String username, String password, String captcha,HttpSession session) {\n" +
+ "\tString sessionCaptcha = (String) session.getAttribute(\"vulCaptcha\");\n" +
+ "\t// 万能验证码：6666\n" +
+ "\tif (\"6666\".equals(captcha) || (sessionCaptcha != null && sessionCaptcha.equalsIgnoreCase(captcha))) {\n" +
+ "\t\t// 及时清除旧验证码\n" +
+ "\t\tsession.removeAttribute(\"vulCaptcha\");\n" +
+ "\t\tif (REAL_USERNAME.equals(username) && REAL_PASSWORD.equals(password)) {\n" +
+ "\t\t\treturn R.ok(\"账号爆破成功！用户名：\" + username + \",密码：\" + password);\n" +
+ "\t\t}else return R.error(\"账号或密码错误!\");\n" +
+ "\t}else {\n" +
+ "\t\tsession.removeAttribute(\"vulCaptcha\");\n" +
+ "\t\treturn R.error(\"验证码错误！\");\n" +
+ "\t}\n" +
+ "}"
+const vul3Graphic = "public R vul3(String username, String password, String captcha, HttpSession session) {\n" +
+ "\tString sessionCaptcha = (String) session.getAttribute(\"vulCaptcha\");\n" +
+ "\tif (sessionCaptcha != null && sessionCaptcha.equalsIgnoreCase(captcha)) {\n" +
+ "\t\tsession.removeAttribute(\"vulCaptcha\");\n" +
+ "\t\tif (REAL_USERNAME.equals(username) && REAL_PASSWORD.equals(password)) {\n" +
+ "\t\t\treturn R.ok(\"账号爆破成功！用户名：\" + username + \",密码：\" + password);\n" +
+ "\t\t} else return R.error(\"账号或密码错误!\");\n" +
+ "\t} else {\n" +
+ "\t\tsession.removeAttribute(\"vulCaptcha\");\n" +
+ "\t\treturn R.error(\"验证码错误！\");\n" +
+ "\t}\n" +
+ "}"
+const safeGraphic = "public R safe(String username, String password, String captcha, HttpSession session) {\n" +
+ " String sessionCaptcha = (String) session.getAttribute(\"safeCaptcha\");\n" +
+ " Long captchaTimestamp = (Long) session.getAttribute(\"captchaTimestamp\");\n" +
+ " // 验证验证码是否已失效（1分钟有效）\n" +
+ " if (captchaTimestamp == null || System.currentTimeMillis() - captchaTimestamp > 60 * 1000) {\n" +
+ " session.removeAttribute(\"safeCaptcha\");\n" +
+ " session.removeAttribute(\"captchaTimestamp\");\n" +
+ " return R.error(\"验证码已失效，请重新获取！\");\n" +
+ " }\n" +
+ " if (sessionCaptcha != null && sessionCaptcha.equalsIgnoreCase(captcha)) {\n" +
+ " session.removeAttribute(\"safeCaptcha\");\n" +
+ " session.removeAttribute(\"captchaTimestamp\");\n" +
+ " if (REAL_USERNAME.equals(username) && REAL_PASSWORD.equals(password)) {\n" +
+ " return R.ok(\"登录成功！用户名：\" + username + \",密码：\" + password);\n" +
+ " } else {\n" +
+ " return R.error(\"账号或密码错误!\");\n" +
+ " }\n" +
+ " } else {\n" +
+ " session.removeAttribute(\"safeCaptcha\");\n" +
+ " session.removeAttribute(\"captchaTimestamp\");\n" +
+ " return R.error(\"验证码错误，请重新输入！\");\n" +
+ " }\n" +
+ "}\n" +
+ "\n" +
+ "// 设置图形验证码长度6位\n" +
+ "ShearCaptcha shearCaptcha = CaptchaUtil.createShearCaptcha(90, 30, 6, 3);"
+
+const vul1SMS = "public R code(String phone, HttpSession session) {\n" +
+ " ...\n" +
+ " Random random = new Random();\n" +
+ " // 随机生成6位数验证码\n" +
+ " String captcha = String.valueOf(100000 + random.nextInt(900000));\n" +
+ " session.setAttribute(\"phone\", phone);\n" +
+ " session.setAttribute(\"smsCode\", captcha);\n" +
+ " session.setAttribute(\"captchaTimestamp\", System.currentTimeMillis());\n" +
+ " // 错误的将短信验证码回显在响应包中\n" +
+ " return R.ok(\"发送验证码成功！\" + captcha);\n" +
+ "}"
+const vul2SMS = "public R vul2(String phone, String code, @RequestParam(required = false, defaultValue = \"false\") boolean code_verify, HttpSession session) {\n" +
+ " ...\n" +
+ " // 校验code_verify字段，如果为true则验证登录成功\n" +
+ " if (code_verify){\n" +
+ " return R.ok(\"验证通过！用户：\"+phone);\n" +
+ " }\n" +
+ " if (!sessionCaptcha.equals(code)) {\n" +
+ " return R.error(\"验证码错误，请重新输入！\");\n" +
+ " }\n" +
+ " ...\n" +
+ " return R.ok(\"验证通过！用户：\"+phone);\n" +
+ "}"
+
+
// 越权漏洞
-const vulHorizon = "public String vul(){\n" +
- "\tString currentUsername = SecurityContextHolder.getContext().getAuthentication().getName();\n" +
- "\tif (\"admin\".equals(currentUsername)) {\n" +
- "\t\treturn \"common/401\";\n" +
- "\t}else return \"/vul/logic/idor/admin\";\n" +
+const vulHorizon = "public R vul(String username){\n" +
+ " User user = userMapper.getAllByUsername(username);\n" +
+ " if (user!=null){\n" +
+ " return R.ok(\"用户名：\"+user.getUsername()+\" 密码：\"+user.getPassword());\n" +
+ " }else return R.error(\"用户名不存在\");\n" +
"}"
const safeHorizon = "public R safe(String username){\n" +
" // 获取当前登录的用户名\n" +
" String currentUsername = SecurityContextHolder.getContext().getAuthentication().getName();\n" +
" // 检查当前请求的用户名是否和登录用户名一致\n" +
- " if (!username.equals(currentUsername)) {\n" +
+ " if (username == null || !username.equals(currentUsername)) {\n" +
" return R.error(\"您没有权限查看该用户的资料,当前登录用户：\"+currentUsername);\n" +
" }\n" +
" // 查询用户信息\n" +
@@ -1074,9 +1534,158 @@ const safeHorizon = "public R safe(String username){\n" +
" return R.error(\"用户名不存在\");\n" +
" }\n" +
"}"
+const vulVertical = "public String vul() {\n" +
+ " // 漏洞点：只要知道管理员功能地址即可直接访问，没有做服务端角色校验。\n" +
+ " return \"vul/logic/idor/admin\";\n" +
+ "}"
// 支付漏洞
+const vul1Pay = "public R vul1(@RequestParam String count, @RequestParam String price) {\n" +
+ " try {\n" +
+ " double totalPrice = Integer.parseInt(count) * Double.parseDouble(price);\n" +
+ " log.info(\"用户需支付金额：\" + totalPrice);\n" +
+ " \n" +
+ " // 直接使用客户端传入的价格，未与服务端商品实际价格进行校验\n" +
+ " BigDecimal currentMoney = userMoney.get();\n" +
+ " if (currentMoney.compareTo(BigDecimal.valueOf(totalPrice)) < 0) {\n" +
+ " return R.error(\"支付金额不足，支付失败！\");\n" +
+ " }\n" +
+ " userMoney.set(currentMoney.subtract(BigDecimal.valueOf(totalPrice)));\n" +
+ " return R.ok(\"支付成功！剩余余额：\" + userMoney.get());\n" +
+ " } catch (Exception e) {\n" +
+ " return R.error(e.toString());\n" +
+ " }\n" +
+ "}";
+const vul2Pay = "public R vul2(@RequestParam String orderId, @RequestParam double amount) {\n" +
+ " // 未检查订单是否已支付\n" +
+ " // 这里应该使用paymentStatusMap检查订单是否已支付，但为了演示漏洞，故意不检查\n" +
+ " BigDecimal currentMoney = userMoney.get();\n" +
+ " if (currentMoney.compareTo(BigDecimal.valueOf(amount)) < 0) {\n" +
+ " return R.error(\"余额不足\");\n" +
+ " }\n" +
+ " userMoney.set(currentMoney.subtract(BigDecimal.valueOf(amount)));\n" +
+ " return R.ok(\"支付成功！剩余余额：\" + userMoney.get());\n" +
+ "}";
+
+const vul3Pay = "public R vul3(@RequestParam String orderId, @RequestParam double amount) {\n" +
+ " // 模拟处理延迟\n" +
+ " try {\n" +
+ " Thread.sleep(1000);\n" +
+ " } catch (InterruptedException e) {\n" +
+ " Thread.currentThread().interrupt();\n" +
+ " }\n" +
+ "\n" +
+ " BigDecimal currentMoney = userMoney.get();\n" +
+ " if (currentMoney.compareTo(BigDecimal.valueOf(amount)) < 0) {\n" +
+ " return R.error(\"余额不足\");\n" +
+ " }\n" +
+ " userMoney.set(currentMoney.subtract(BigDecimal.valueOf(amount)));\n" +
+ " return R.ok(\"支付成功！剩余余额：\" + userMoney.get());\n" +
+ "}";
+
+const vulConcurrent = "public R vul(@RequestParam String orderId, @RequestParam double amount) {\n" +
+ " // 模拟业务处理耗时，扩大并发窗口\n" +
+ " Thread.sleep(1000);\n" +
+ "\n" +
+ " BigDecimal currentMoney = userMoney.get();\n" +
+ " BigDecimal payAmount = BigDecimal.valueOf(amount);\n" +
+ " if (currentMoney.compareTo(payAmount) < 0) {\n" +
+ " return R.error(\"余额不足\");\n" +
+ " }\n" +
+ " // 漏洞点：读取余额和写回余额不是一个原子操作，相同订单也没有幂等校验\n" +
+ " userMoney.set(currentMoney.subtract(payAmount));\n" +
+ " return R.ok(\"支付成功！订单：\" + orderId + \"，剩余余额：\" + userMoney.get());\n" +
+ "}";
+
+const safeConcurrent = "public R safe(@RequestParam String orderId, @RequestParam double amount) {\n" +
+ " BigDecimal payAmount = BigDecimal.valueOf(amount);\n" +
+ " synchronized (paymentLock) {\n" +
+ " if (paidOrders.contains(orderId)) {\n" +
+ " return R.error(\"订单已支付，拒绝重复扣款：\" + orderId);\n" +
+ " }\n" +
+ " BigDecimal currentMoney = userMoney.get();\n" +
+ " if (currentMoney.compareTo(payAmount) < 0) {\n" +
+ " return R.error(\"余额不足\");\n" +
+ " }\n" +
+ " paidOrders.add(orderId);\n" +
+ " userMoney.set(currentMoney.subtract(payAmount));\n" +
+ " return R.ok(\"支付成功！订单：\" + orderId + \"，剩余余额：\" + userMoney.get());\n" +
+ " }\n" +
+ "}";
+
+const vul4Pay = "@ApiOperation(\"支付流程绕过漏洞 - 创建订单\")\n" +
+ "@RequestMapping(\"/vul4/create\")\n" +
+ "public R createOrder(@RequestParam String orderId, @RequestParam double amount) {\n" +
+ " OrderStatus status = new OrderStatus(orderId, BigDecimal.valueOf(amount));\n" +
+ " orderStatusMap.put(orderId, status);\n" +
+ " Map data = new HashMap<>();\n" +
+ " data.put(\"orderId\", orderId);\n" +
+ " data.put(\"amount\", amount);\n" +
+ " return R.ok(\"订单创建成功\").put(\"data\", data);\n" +
+ "}\n" +
+ "\n" +
+ "@ApiOperation(\"支付流程绕过漏洞 - 查询订单状态\")\n" +
+ "@RequestMapping(\"/vul4/status\")\n" +
+ "public R getOrderStatus(@RequestParam String orderId) {\n" +
+ " OrderStatus status = orderStatusMap.get(orderId);\n" +
+ " if (status == null) {\n" +
+ " return R.error(\"订单不存在\");\n" +
+ " }\n" +
+ " Map data = new HashMap<>();\n" +
+ " data.put(\"orderId\", status.orderId);\n" +
+ " data.put(\"amount\", status.amount);\n" +
+ " data.put(\"isPaid\", status.isPaid);\n" +
+ " return R.ok().put(\"data\", data);\n" +
+ "}\n" +
+ "\n" +
+ "@ApiOperation(\"支付流程绕过漏洞 - 支付通知\")\n" +
+ "@RequestMapping(\"/vul4/notify\")\n" +
+ "public R paymentNotify(@RequestParam String orderId, @RequestParam boolean success) {\n" +
+ " // 未验证通知来源，直接更新订单状态\n" +
+ " OrderStatus status = orderStatusMap.get(orderId);\n" +
+ " if (status == null) {\n" +
+ " return R.error(\"订单不存在\");\n" +
+ " }\n" +
+ " status.isPaid = success;\n" +
+ " return R.ok(\"状态更新成功\");\n" +
+ "}";
+const vul5Pay = "public R integerOverflow(@RequestParam String count, @RequestParam String price) {\n" +
+ " try {\n" +
+ " Integer countValue = Integer.valueOf(count);\n" +
+ " Integer priceValue = Integer.valueOf(price);\n" +
+ "\n" +
+ " // 整数溢出场景：当 count 或 price 数值过大时，可能会导致溢出\n" +
+ " int totalAmount = countValue * priceValue;\n" +
+ " log.info(\"用户需支付金额：\" + totalAmount);\n" +
+ "\n" +
+ " BigDecimal currentMoney = userMoney.get();\n" +
+ " if (currentMoney.compareTo(BigDecimal.valueOf(totalAmount)) < 0) {\n" +
+ " return R.error(\"支付金额不足，支付失败！\");\n" +
+ " }\n" +
+ " userMoney.set(currentMoney.subtract(BigDecimal.valueOf(totalAmount)));\n" +
+ " return R.ok(\"支付成功！剩余余额：\" + userMoney.get());\n" +
+ " } catch (Exception e) {\n" +
+ " return R.error(\"无效的输入，请输入有效的数量和价格！\");\n" +
+ " }\n" +
+ "}";
+const vul6Pay = "public R floatingPointPrecision(@RequestParam String count, @RequestParam String price) {\n" +
+ " try {\n" +
+ " double totalAmount = Double.parseDouble(count) * Double.parseDouble(price);\n" +
+ " // 漏洞点：把二进制浮点计算结果直接转成金额，可能引入精度误差\n" +
+ " BigDecimal amountValue = new BigDecimal(totalAmount);\n" +
+ " log.info(\"用户需支付金额：\" + amountValue);\n" +
+ "\n" +
+ " BigDecimal currentMoney = userMoney.get();\n" +
+ " if (currentMoney.compareTo(amountValue) < 0) {\n" +
+ " return R.error(\"支付金额不足，支付失败！\");\n" +
+ " }\n" +
+ " userMoney.set(currentMoney.subtract(amountValue));\n" +
+ " return R.ok(\"支付成功！实际扣款金额：\" + amountValue + \"，剩余余额：\" + userMoney.get());\n" +
+ " } catch (Exception e) {\n" +
+ " return R.error(\"无效的输入，请输入有效的数量和价格！\");\n" +
+ " }\n" +
+ "}";
// 其他漏洞
const vul1SpringMvcRedirect = "// 基于Spring MVC的重定向方式\n" +
@@ -1179,17 +1788,31 @@ const vulXffforgery = "public String vul1(HttpServletRequest request, Model mode
"}";
const safeXffforgery = "public String safe(HttpServletRequest request, HttpServletResponse response, Model model, String xff){\n" +
- " ...\n" +
- " if (!isTrustedProxy(remoteHost)){\n" +
- " model.addAttribute(\"clientIP\", request.getRemoteAddr());\n" +
- " model.addAttribute(\"sensitiveInfo\", \"源ip不在白名单范围内！\");\n" +
+ " String proxyIp = request.getRemoteAddr();\n" +
+ " String remoteHost = proxyIp;\n" +
+ " if (\"true\".equals(xff)) {\n" +
+ " if (!isTrustedProxy(proxyIp)){\n" +
+ " model.addAttribute(\"clientIP\", proxyIp);\n" +
+ " model.addAttribute(\"sensitiveInfo\", \"非可信代理来源，忽略XFF头：\" + proxyIp);\n" +
+ " return \"vul/other/onlyForGoogle\";\n" +
+ " }\n" +
+ " remoteHost = getFirstForwardedIp(request.getHeader(\"X-Forwarded-For\"));\n" +
+ " }\n" +
+ " if (remoteHost == null || remoteHost.isEmpty()) {\n" +
+ " model.addAttribute(\"clientIP\", proxyIp);\n" +
+ " model.addAttribute(\"sensitiveInfo\", \"XFF头为空或格式异常！\");\n" +
" return \"vul/other/onlyForGoogle\";\n" +
" }\n" +
- " ...\n" +
+ " boolean isClientIP8888 = \"8.8.8.8\".equals(remoteHost);\n" +
+ " model.addAttribute(\"clientIP\", remoteHost);\n" +
+ " if (isClientIP8888) {\n" +
+ " model.addAttribute(\"sensitiveInfo\", \"username:admin,password:Admin123\");\n" +
+ " }\n" +
+ " return \"vul/other/onlyForGoogle\";\n" +
"}\n" +
"// 判断是否来自可信代理\n" +
"private boolean isTrustedProxy(String ip) {\n" +
- " return Arrays.asList(\"127.0.0.1\", \"192.168.1.1\", \"10.0.0.1\").contains(ip);\n" +
+ " return Arrays.asList(\"192.168.1.1\", \"10.0.0.1\").contains(ip);\n" +
"}"
const vulCsrf = "public R vul(String receiver, String amount, @AuthenticationPrincipal UserDetails userDetails){\n" +
@@ -1205,7 +1828,7 @@ const safeCsrfToken = "public Map safeCsrf(String receiver,Strin
"\n" +
" String sessionToken = (String) session.getAttribute(\"csrfToken\");\n" +
" Map result = new HashMap<>();\n" +
- " if (!csrfToken.equals(sessionToken)) {\n" +
+ " if (!constantTimeEquals(csrfToken, sessionToken)) {\n" +
" result.put(\"success\", false);\n" +
" result.put(\"message\", \"Token失效！\");\n" +
" return result;\n" +
@@ -1215,25 +1838,53 @@ const safeCsrfToken = "public Map safeCsrf(String receiver,Strin
" result.put(\"amount\", amount);\n" +
" result.put(\"csrfToken\", csrfToken);\n" +
" return result;\n" +
+ "}\n" +
+ "\n" +
+ "private boolean constantTimeEquals(String requestToken, String sessionToken) {\n" +
+ " if (requestToken == null || sessionToken == null) {\n" +
+ " return false;\n" +
+ " }\n" +
+ " return MessageDigest.isEqual(\n" +
+ " requestToken.getBytes(StandardCharsets.UTF_8),\n" +
+ " sessionToken.getBytes(StandardCharsets.UTF_8)\n" +
+ " );\n" +
"}"
const safeCsrfReferer = "public Map safe2(HttpServletRequest request,String receiver,String amount, @AuthenticationPrincipal UserDetails userDetails, HttpSession session) {\n" +
" String currentUser = userDetails.getUsername();\n" +
" Map result = new HashMap<>();\n" +
- " String referer = request.getHeader(\"referer\");\n" +
- " if (referer == null || !referer.startsWith(\"http://127.0.0.1\")) {\n" +
+ " String originOrReferer = request.getHeader(\"Origin\");\n" +
+ " if (originOrReferer == null) {\n" +
+ " originOrReferer = request.getHeader(\"Referer\");\n" +
+ " }\n" +
+ " if (!isTrustedSameOrigin(request, originOrReferer)) {\n" +
" result.put(\"success\", false);\n" +
- " result.put(\"message\", \"referer无效！\");\n" +
+ " result.put(\"message\", \"Origin/Referer无效！\");\n" +
" return result;\n" +
" }\n" +
" result.put(\"currentUser\", currentUser);\n" +
" result.put(\"receiver\", receiver);\n" +
" result.put(\"amount\", amount);\n" +
" return result;\n" +
+ "}\n" +
+ "\n" +
+ "private boolean isTrustedSameOrigin(HttpServletRequest request, String originOrReferer) {\n" +
+ " if (originOrReferer == null) {\n" +
+ " return false;\n" +
+ " }\n" +
+ " try {\n" +
+ " URI uri = new URI(originOrReferer);\n" +
+ " int actualPort = uri.getPort() == -1 ? defaultPort(uri.getScheme()) : uri.getPort();\n" +
+ " return request.getScheme().equalsIgnoreCase(uri.getScheme())\n" +
+ " && request.getServerName().equalsIgnoreCase(uri.getHost())\n" +
+ " && request.getServerPort() == actualPort;\n" +
+ " } catch (URISyntaxException e) {\n" +
+ " return false;\n" +
+ " }\n" +
"}"
// 跨域安全问题
-const vulCORS = "public String vul(HttpServletRequest request, HttpServletResponse response) {\n" +
- " String origin = request.getHeader(\"origin\");\n" +
+const vulCORS = "public R vul(HttpServletRequest request, HttpServletResponse response) {\n" +
+ " String origin = request.getHeader(\"Origin\");\n" +
"\n" +
" if (origin != null) {\n" +
" response.setHeader(\"Access-Control-Allow-Origin\", origin);\n" +
@@ -1244,21 +1895,36 @@ const vulCORS = "public String vul(HttpServletRequest request, HttpServletRespon
" // 允许携带 Cookie 或其他凭证\n" +
" response.setHeader(\"Access-Control-Allow-Credentials\", \"true\");\n" +
" response.setHeader(\"Access-Control-Allow-Methods\", \"GET, POST, PUT, DELETE, OPTIONS\");\n" +
+ " response.setHeader(\"Access-Control-Allow-Headers\", \"Content-Type, Authorization, X-Requested-With\");\n" +
+ " response.setHeader(\"Vary\", \"Origin\");\n" +
"\n" +
- " return \"CORS漏洞演示：username:admin,password:Admin123\";\n" +
+ " return R.ok(\"CORS漏洞演示：username:admin,password:Admin123\");\n" +
"}"
-const safeCORS = "@CrossOrigin(origins = {\"http://127.0.0.1:8080\", \"https://127.0.0.1:8080\"}, allowCredentials = \"true\")\n" +
- "public String safe(HttpServletRequest request, HttpServletResponse response) {\n" +
- " // 记录安全 CORS 请求来源\n" +
- " String origin = request.getHeader(\"origin\");\n" +
- " // 允许携带凭证，但前提是 `Access-Control-Allow-Origin` 与可信来源匹配\n" +
+const safeCORS = "private static final Set TRUSTED_ORIGINS = new HashSet<>(Arrays.asList(\n" +
+ " \"http://127.0.0.1:8080\",\n" +
+ " \"https://127.0.0.1:8080\"\n" +
+ "));\n" +
+ "\n" +
+ "public R safe(HttpServletRequest request, HttpServletResponse response) {\n" +
+ " String origin = request.getHeader(\"Origin\");\n" +
+ " response.setHeader(\"Vary\", \"Origin\");\n" +
+ " if (origin == null) {\n" +
+ " return R.ok(\"同源请求不需要CORS响应头\");\n" +
+ " }\n" +
+ " if (!TRUSTED_ORIGINS.contains(origin)) {\n" +
+ " response.setStatus(HttpServletResponse.SC_FORBIDDEN);\n" +
+ " return R.error(HttpServletResponse.SC_FORBIDDEN, \"Origin不在CORS白名单\");\n" +
+ " }\n" +
+ " response.setHeader(\"Access-Control-Allow-Origin\", origin);\n" +
" response.setHeader(\"Access-Control-Allow-Credentials\", \"true\");\n" +
+ " response.setHeader(\"Access-Control-Allow-Methods\", \"GET, OPTIONS\");\n" +
+ " response.setHeader(\"Access-Control-Allow-Headers\", \"Content-Type\");\n" +
"\n" +
- " return \"配置CORS可信源白名单\";\n" +
+ " return R.ok(\"配置CORS可信源白名单\");\n" +
"}\n"
-const vulJSONP = 'public void vul(HttpServletRequest request, HttpServletResponse response) throws IOException, java.io.IOException {\n' +
+const vulJSONP = 'public void vul(HttpServletRequest request, HttpServletResponse response) throws IOException {\n' +
' String callback = request.getParameter("callback");\n' +
' String sensitiveData = "{\\"username\\":\\"admin\\",\\"password\\":\\"Admin123\\"}";\n' +
'\n' +
@@ -1266,15 +1932,27 @@ const vulJSONP = 'public void vul(HttpServletRequest request, HttpServletRespons
' String jsonpResponse = callback + "(" + sensitiveData + ");";\n' +
'\n' +
' // 设置响应类型为 JavaScript 脚本\n' +
- ' response.setContentType("application/javascript");\n' +
+ ' response.setContentType("application/javascript;charset=UTF-8");\n' +
' response.getWriter().write(jsonpResponse);\n' +
'}\n'
-const safeJSONP = "// 校验回调函数名是否合法\n" +
- "if (callback == null || !callback.matches(\"^[a-zA-Z_$][a-zA-Z0-9_$]*$\")) {\n" +
- " response.setStatus(HttpServletResponse.SC_BAD_REQUEST);\n" +
- " response.getWriter().write(\"Invalid callback\");\n" +
- " return;\n" +
+const safeJSONP = "private static final Pattern JSONP_CALLBACK_PATTERN = Pattern.compile(\n" +
+ " \"^[A-Za-z_$][A-Za-z0-9_$]*(\\\\.[A-Za-z_$][A-Za-z0-9_$]*)*$\"\n" +
+ ");\n" +
+ "\n" +
+ "public void safe(HttpServletRequest request, HttpServletResponse response) throws IOException {\n" +
+ " String callback = request.getParameter(\"callback\");\n" +
+ " // 校验回调函数名是否合法\n" +
+ " if (callback == null || !JSONP_CALLBACK_PATTERN.matcher(callback).matches()) {\n" +
+ " response.setStatus(HttpServletResponse.SC_BAD_REQUEST);\n" +
+ " response.getWriter().write(\"Invalid callback\");\n" +
+ " return;\n" +
+ " }\n" +
+ "\n" +
+ " String publicData = \"{\\\"message\\\":\\\"public data only\\\"}\";\n" +
+ " response.setContentType(\"application/javascript;charset=UTF-8\");\n" +
+ " response.setHeader(\"X-Content-Type-Options\", \"nosniff\");\n" +
+ " response.getWriter().write(callback + \"(\" + publicData + \");\");\n" +
"}"
const vulDos = "public void vul(Integer width,Integer height,HttpServletResponse response) throws IOException {\n" +
@@ -1289,6 +1967,19 @@ const vulDos = "public void vul(Integer width,Integer height,HttpServletResponse
" throw new RuntimeException(e);\n" +
" }\n" +
"}"
+const safeDos = "public void safe(Integer width,Integer height,HttpServletResponse response) throws IOException {\n" +
+ " if (width == null || height == null || width <= 0 || height <= 0\n" +
+ " || width > MAX_IMAGE_WIDTH || height > MAX_IMAGE_HEIGHT\n" +
+ " || (long) width * height > MAX_IMAGE_PIXELS) {\n" +
+ " response.setStatus(HttpServletResponse.SC_BAD_REQUEST);\n" +
+ " response.setContentType(\"text/plain;charset=UTF-8\");\n" +
+ " response.getWriter().write(\"图片尺寸超出限制\");\n" +
+ " return;\n" +
+ " }\n" +
+ " response.setContentType(\"image/jpeg\");\n" +
+ " ShearCaptcha shearCaptcha = CaptchaUtil.createShearCaptcha(width, height, 4, 3);\n" +
+ " shearCaptcha.write(response.getOutputStream());\n" +
+ "}"
const vul2Dos = "// 如果解压出的文件是ZIP文件，则递归解压\n" +
"if (entry.getName().endsWith(\".zip\")) {\n" +
" // 创建临时文件来存储这个ZIP\n" +
@@ -1333,16 +2024,13 @@ const safeXpath = "public R safe(String username,String password) {\n" +
" String xml = \"admin password druidStatViewServlet() {\n" +
+ " ServletRegistrationBean registrationBean =\n" +
+ " new ServletRegistrationBean<>(new StatViewServlet(), \"/druid/*\");\n" +
+ " registrationBean.addInitParameter(\"resetEnable\", \"false\");\n" +
+ " return registrationBean;\n" +
+ " }\n" +
+ "}\n" +
+ "\n" +
+ "// SecurityConfigurer 中放行 /druid/**，且未设置登录账号密码，会导致Druid监控台暴露。"
const dirTraversal = 'public String listDirectory(String dir) {\n' +
' String staticFolderPath = sysConstant.getStaticFolder();\n' +
@@ -1488,15 +2218,18 @@ const safe1ListDirectory = 'public String safe1(String dir) {\n' +
'}'
const safe2ListDirectory = "public String safe2(String dir) {\n" +
- " String staticFolderPath = sysConstant.getStaticFolder();\n" +
- " File baseDir = new File(staticFolderPath);\n" +
- " File requestedDir = new File(baseDir, dir);\n" +
+ " File baseDir = resolveStaticBaseDir();\n" +
+ " String relativeDir = normalizeRelativeDir(dir);\n" +
"\n" +
" // 检查请求的目录是否在规定目录内\n" +
"try {\n" +
- " if (!requestedDir.getCanonicalPath().startsWith(baseDir.getCanonicalPath()) || !requestedDir.isDirectory()) {\n" +
+ " Path basePath = baseDir.getCanonicalFile().toPath();\n" +
+ " File requestedDir = new File(baseDir, relativeDir);\n" +
+ " Path requestedPath = requestedDir.getCanonicalFile().toPath();\n" +
+ " if (!requestedPath.startsWith(basePath) || !requestedDir.isDirectory()) {\n" +
" return \"Directory not found or access denied.\";\n" +
" }\n" +
+ " return renderDirectoryListing(dir, requestedDir, true);\n" +
"} catch (IOException e) {\n" +
" return \"Error resolving directory path.\";\n" +
"}\n" +
@@ -1523,47 +2256,170 @@ const infoLeakCeShi = "public String ping(String ip, Model model) {\n" +
" ...\n" +
"}\n";
+// 登录对抗
+const vul1Account = "public class CustomUserDetailsService implements UserDetailsService {\n" +
+ " @Autowired\n" +
+ " private UserService userService;\n" +
+ "\t\n" +
+ " @Override\n" +
+ " public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {\n" +
+ " User sysUser = userService.getOne(Wrappers.query().lambda().eq(User::getUsername, username));\n" +
+ " if (ObjectUtil.isNull(sysUser)) {\n" +
+ " throw new UsernameNotFoundException(\"用户不存在\");\n" +
+ " // 安全写法：统一返回模糊错误信息\n" +
+ "\t\t// throw new UsernameNotFoundException(\"用户或密码错误\");\n" +
+ " }\n" +
+ "\n" +
+ " // 用户存在，直接返回 UserDetails 对象，不处理角色信息\n" +
+ " return new org.springframework.security.core.userdetails.User(sysUser.getUsername(), sysUser.getPassword(), new ArrayList<>());\n" +
+ " }\n" +
+ "}"
+const vul2Account = "public R vul2(String username, String password) {\n" +
+ "\t\n" +
+ "\t// 这里简单模拟下数据库查询操作\n" +
+ "\t// User user = UserService.getAllByUsernameAndPassword(username,password)\n" +
+ "\tif (\"admin\".equalsIgnoreCase(username) && \"admin\".equalsIgnoreCase(password)) {\n" +
+ "\t\treturn R.ok(\"登录成功！用户名：\" + username + \", 密码：\" + password);\n" +
+ "\t} else {\n" +
+ "\t\treturn R.ok(\"账号或密码错误！\");\n" +
+ "\t}\n" +
+ "}"
+
+const vul1Bypass = "$.ajax({\n" +
+ "type: 'POST',\n" +
+ "url: '/loginconfront/bypass/vul1step1',\n" +
+ "data: data.field,\n" +
+ "success: function (response) {\n" +
+ "\t// 步骤一账号校验通过后，模拟进行下一步校验\n" +
+ " if (response.code === 0) {\n" +
+ " $(\"#vul1-bypass-result\").text(response.msg);\n" +
+ " setTimeout(() => {\n" +
+ " $.ajax({\n" +
+ " type: 'POST',\n" +
+ " url: '/loginconfront/bypass/vul1step2',\n" +
+ " data: {code: response.code},\n" +
+ " ..."
+const vul2Bypass = "// step1：验证用户名并切换到步骤2\n" +
+ "$('#next1').on('click', function () {\n" +
+ " $.post('/loginconfront/bypass/step1', { username: username }, function (res) {\n" +
+ " if (res.code === 0) currentStep = 2;\n" +
+ " });\n" +
+ "});\n" +
+ "\n" +
+ "// step2：验证旧密码并切换到步骤3\n" +
+ "$('#next2').on('click', function () {\n" +
+ " $.post('/loginconfront/bypass/step2', { oldPassword: oldPassword }, function (res) {\n" +
+ " if (res.code === 0) currentStep = 3;\n" +
+ " });\n" +
+ "});\n" +
+ "\n" +
+ "// step3：提交新密码\n" +
+ "$('#reset-password-form').on('submit', function (e) {\n" +
+ " $.post('/loginconfront/bypass/step3', { newPassword: newPassword });\n" +
+ "});"
+const vul1Reverse = "// 与服务端密钥一致 用于生产签名Sign\n" +
+ "const key = \"FF38DC304A1D74B19F24A36C09FD6B72\";\n" +
+ "function generateSign(params) {\n" +
+ " const query = Object.keys(params)\n" +
+ " .sort()\n" +
+ " .map(k => `${k}=${params[k]}`)\n" +
+ " .join(\"&\");\n" +
+ " // 使用 MD5 加密生成签名\n" +
+ " return md5(query + key);\n" +
+ "}\n" +
+ "const params = {\n" +
+ " username: data.field.username,\n" +
+ " password: data.field.password,\n" +
+ " timestamp: Date.now(),\n" +
+ "};\n" +
+ "const sign = generateSign(params);\n" +
+ "\n" +
+ "{\"username\":\"admin\",\"password\":\"123456\",\"timestamp\":1732373468477,\"sign\":\"1a56f2b3de87c435be816341d9bcf6fe\"}"
+const vul2Reverse = "const publicKey = `-----BEGIN PUBLIC KEY-----\n" +
+ "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx6Iq6tBvjNHqczQmJJAo\n" +
+ "otsBfKM/9yJCuTV87ZlI0Y1EFG65Jo89aLHW7BqBUJepcKC9kcA5PJaWSF5BYElt\n" +
+ "Y2NPnIfGkHamKeFywWh4aYy66MlBqr91Fw0Wyx8PQlp0CJKfiPEQmzwUobpimAvK\n" +
+ "...\n" +
+ "-----END PUBLIC KEY-----\n" +
+ "`;\n" +
+ "\n" +
+ "const encryptField = (field) => {\n" +
+ " const encryptor = new JSEncrypt();\n" +
+ " encryptor.setPublicKey(publicKey);\n" +
+ " return encryptor.encrypt(field);\n" +
+ "};\n" +
+ "\n" +
+ "const encryptedUsername = encryptField(data.field.username);\n" +
+ "const encryptedPassword = encryptField(data.field.password);\n" +
+ "\n" +
+ "{\"encryptedUsername\":\"iDF5BNv1zaM0V9qog0qzlUES3sCGYqmvrKiqPIvUgP5qE0pYn9XN3btW3PbRwLuySeruK2i8lem+L67w5+fFQBuRrpettLrHl8izIRp2W+nq9o9Kg/LSa3/+JynFoUHxrvQ2taNM1nustROpkBjJMbTOK52S6ZBa0quMw+wjfR1XExlzc99U1WJQfRAqj7Gsl9EPydRIh8vs4S/Nen5kf/dL3ZikfMbCUUBonRlYy6a3nWJ412P+hxRbSl80Z8aQKw9lH4+Iju80oFmQ6DuS6Ce70h88z/Va+xzXHDzM8w6h5iqQLzq3Kj/E+b/wsn6eM7v+LEC8LwLQ/t8z8tki9g==\",\n" +
+ "\"encryptedPassword\":\"nDI0/PBwsFHnRRw7Z4gHZ6G8Uaq7BUjUxnTDw7bkR9nrTkoHfcDLKUddj2JS7WWbOyuwsUFce3/tXJYQWNMFQqGRtf6jXxFAlvTvBkRdsZXOIU+Abb4EqYw670xd5UTeAQ0lI5KNXtw6e/VbnXyX+STJdN2SO7FLbvZ4sM6gLQSVWLo/+pZsYxKlEUNxew2svlzDZtqKnyF12bzakWfzaWuovLnYCCEXV1oAJCErjgfoOS2wJADdgU0wE6KlFDMNjsCvONmO6KZpmJQ1GOq3MpyqySq8eyJkYG3cDSRo5nDo2YOcevOHifzMnKbrU9gh4/RUj8sxrykdqgLmzX3rhw==\"}"
+
+const vul1Credential = "public R generateJWT(String username, String role) {\n" +
+ " String jwt = Jwts.builder()\n" +
+ " .setSubject(username)\n" +
+ " .claim(\"role\", role)\n" +
+ " .signWith(jwtKey())\n" +
+ " .compact();\n" +
+ " return R.ok(jwt);\n" +
+ "}\n" +
+ "\n" +
+ "public R vul1(String jwt) {\n" +
+ " String user = Jwts.parser()\n" +
+ " .setSigningKey(jwtKey())\n" +
+ " .parseClaimsJws(jwt)\n" +
+ " .getBody()\n" +
+ " .getSubject();\n" +
+ " String role = Jwts.parserBuilder()\n" +
+ " .setSigningKey(jwtKey())\n" +
+ " .build()\n" +
+ " .parseClaimsJws(jwt)\n" +
+ " .getBody()\n" +
+ " .get(\"role\", String.class);\n" +
+ " return R.ok(\"JWT解析成功，user：\" + user + \",role：\" + role);\n" +
+ "}"
+
+const vul2Credential = "vul2Credential"
+
+
// java专题 SPEL注入
const spelVul = "public R vul(String ex) {\n" +
- " // 创建SpEL解析器，ExpressionParser接口用于表示解析器，SpelExpressionParser为默认实现\n" +
- " ExpressionParser parser = new SpelExpressionParser();\n" +
- " \n" +
- " // Expression expression = parser.parseExpression(ex);\n" +
- " // String result = expression.getValue().toString();\n" +
- " \n" +
- " // 构造上下文 上下文其实就是设置好某些变量的值，执行表达式时根据这些设置好的内容区获取值 在不配置的情况下具有默认类型的上下文\n" +
- " EvaluationContext evaluationContext = new StandardEvaluationContext();\n" +
- " \n" +
- " // 解析表达式，将用户输入的字符串解析为Expression对象\n" +
- " Expression exp = parser.parseExpression(ex);\n" +
- " \n" +
- " // 通过上下文计算表达式的值，并将结果转换为字符串\n" +
- " String result = exp.getValue(evaluationContext).toString();\n" +
- " return R.ok(result);\n" +
+ " try {\n" +
+ " ExpressionParser parser = new SpelExpressionParser();\n" +
+ " EvaluationContext evaluationContext = new StandardEvaluationContext();\n" +
+ " Expression exp = parser.parseExpression(ex);\n" +
+ " Object result = exp.getValue(evaluationContext);\n" +
+ " return R.ok(String.valueOf(result));\n" +
+ " } catch (Exception e) {\n" +
+ " return R.error(\"SPEL表达式执行失败：\" + e.getMessage());\n" +
+ " }\n" +
"}"
const spelSafe = "public R safe(String ex) {\n" +
- " ExpressionParser parser = new SpelExpressionParser();\n" +
- " \n" +
- " // 使用 SimpleEvaluationContext 限制表达式功能(Java类型引用、构造函数调用、Bean引用)，防止危险的操作\n" +
- " EvaluationContext simpleContext = SimpleEvaluationContext.forReadOnlyDataBinding().build();\n" +
- " \n" +
- " Expression exp = parser.parseExpression(ex);\n" +
- " \n" +
- " String result = exp.getValue(simpleContext).toString();\n" +
- " return R.ok(result);\n" +
+ " try {\n" +
+ " ExpressionParser parser = new SpelExpressionParser();\n" +
+ " // 使用 SimpleEvaluationContext 限制 Java 类型引用、构造函数调用、Bean 引用等危险能力\n" +
+ " EvaluationContext simpleContext = SimpleEvaluationContext.forReadOnlyDataBinding().build();\n" +
+ " Expression exp = parser.parseExpression(ex);\n" +
+ " Object result = exp.getValue(simpleContext);\n" +
+ " return R.ok(String.valueOf(result));\n" +
+ " } catch (Exception e) {\n" +
+ " return R.error(\"表达式被安全上下文限制：\" + e.getMessage());\n" +
+ " }\n" +
"}\n"
const sstiVul = "public String vul1(@RequestParam String para, Model model) {\n" +
- " // 用户输入直接拼接到模板路径，可能导致SSTI（服务器端模板注入）漏洞\n" +
- " return \"/vul/ssti/\" + para;\n" +
+ " // 用户输入直接拼接到模板路径，Thymeleaf 会对视图名中的 __${...}__ 做预处理\n" +
+ " return \"vul/ssti/\" + para;\n" +
"}\n" +
"\n" +
- "public void vul2(@PathVariable String path) {\n" +
+ "public String vul2(@PathVariable String path) {\n" +
+ " // URL 路径变量直接拼接到模板路径，同样会触发 Thymeleaf 视图名预处理\n" +
" log.info(\"SSTI注入：\"+path);\n" +
+ " return \"vul/ssti/\" + path;\n" +
"}\n" +
"\n" +
- "\t// 缺陷组件版本参考\n" +
+ "// 缺陷组件版本参考\n" +
"\n" +
" org.springframework.boot \n" +
" spring-boot-starter-parent \n" +
@@ -1580,57 +2436,54 @@ const sstiVul = "public String vul1(@RequestParam String para, Model model) {\n"
const sstiSafe = "public String safe1(String para, Model model) {\n" +
" List white_list = new ArrayList<>(Arrays.asList(\"vul\", \"ssti\"));\n" +
" if (white_list.contains(para)){\n" +
- " return \"vul/ssti\" + para;\n" +
+ " return \"vul/ssti/\" + para;\n" +
" } else{\n" +
" return \"common/401\";\n" +
" }\n" +
"}\n" +
"@GetMapping(\"/safe2/{path}\")\n" +
- "public void safe2(@PathVariable String path, HttpServletResponse response) {\n" +
+ "public void safe2(@PathVariable String path, HttpServletResponse response) throws IOException {\n" +
" log.info(\"SSTI注入：\"+path);\n" +
+ " response.setContentType(\"text/plain;charset=UTF-8\");\n" +
+ " response.getWriter().write(\"已跳过视图解析，输入路径：\" + path);\n" +
"}"
const vulReadObject = "public R vul(String payload) {\n" +
" try {\n" +
- " payload = payload.replace(\" \", \"+\");\n" +
- " byte[] bytes = Base64.getDecoder().decode(payload);\n" +
- " ByteArrayInputStream stream = new ByteArrayInputStream(bytes);\n" +
- " java.io.ObjectInputStream in = new java.io.ObjectInputStream(stream);\n" +
- " in.readObject();\n" +
- " in.close();\n" +
- " return R.ok(\"[+]Java反序列化：ObjectInputStream.readObject()\");\n" +
+ " byte[] bytes = decodePayload(payload);\n" +
+ " Object obj;\n" +
+ " try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes))) {\n" +
+ " obj = in.readObject();\n" +
+ " }\n" +
+ " return R.ok(\"[+]Java反序列化：\" + obj);\n" +
" } catch (Exception e) {\n" +
" return R.error(\"[-]请输入正确的Payload！\\n\"+e.getMessage());\n" +
" }\n" +
- "}"
+"}"
const safeReadObject1 = "public R safe1(String payload) {\n" +
- " // 安全措施：禁用不安全的反序列化\n" +
+ " // 禁用 Commons Collections 不安全反序列化开关\n" +
" System.setProperty(\"org.apache.commons.collections.enableUnsafeSerialization\", \"false\");\n" +
" try {\n" +
- " payload = payload.replace(\" \", \"+\");\n" +
- " byte[] bytes = Base64.getDecoder().decode(payload);\n" +
- " ByteArrayInputStream stream = new ByteArrayInputStream(bytes);\n" +
- " java.io.ObjectInputStream in = new java.io.ObjectInputStream(stream);\n" +
- " in.readObject();\n" +
- " in.close();\n" +
- " return R.ok(\"[+]Java反序列化：ObjectInputStream.readObject()\");\n" +
+ " byte[] bytes = decodePayload(payload);\n" +
+ " try (ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bytes))) {\n" +
+ " in.readObject();\n" +
+ " }\n" +
+ " return R.ok(\"[+]Java反序列化：禁用Commons Collections不安全反序列化开关\");\n" +
" } catch (Exception e) {\n" +
" return R.error(\"[-]请输入正确的Payload！\\n\"+e.getMessage());\n" +
" }\n" +
"}"
const safeReadObject2 = "public R safe2(String payload) {\n" +
" try {\n" +
- " payload = payload.replace(\" \", \"+\");\n" +
- " byte[] bytes = Base64.getDecoder().decode(payload);\n" +
- " ByteArrayInputStream stream = new ByteArrayInputStream(bytes);\n" +
+ " byte[] bytes = decodePayload(payload);\n" +
" // 创建 ValidatingObjectInputStream 对象\n" +
- " ValidatingObjectInputStream ois = new ValidatingObjectInputStream(stream);\n" +
- " // 设置拒绝反序列化的类\n" +
- " ois.reject(java.lang.Runtime.class);\n" +
- " ois.reject(java.lang.ProcessBuilder.class);\n" +
- " // 只允许反序列化Sqli类\n" +
- " ois.accept(Sqli.class);\n" +
- " ois.readObject();\n" +
+ " try (ValidatingObjectInputStream ois = new ValidatingObjectInputStream(new ByteArrayInputStream(bytes))) {\n" +
+ " ois.reject(java.lang.Runtime.class);\n" +
+ " ois.reject(java.lang.ProcessBuilder.class);\n" +
+ " // 只允许反序列化Sqli类\n" +
+ " ois.accept(Sqli.class);\n" +
+ " ois.readObject();\n" +
+ " }\n" +
" return R.ok(\"[+]Java反序列化：ObjectInputStream.readObject()\");\n" +
" } catch (Exception e) {\n" +
" return R.error(\"[-]请输入正确的Payload！\\n\"+e.getMessage());\n" +
@@ -1639,22 +2492,25 @@ const safeReadObject2 = "public R safe2(String payload) {\n" +
const safeReadObject3 = "safeReadObject3"
const vulSnakeYaml = "public R vul(String payload) {\n" +
+ " if (payload == null || payload.trim().isEmpty()) {\n" +
+ " return R.error(\"Payload不能为空\");\n" +
+ " }\n" +
" Yaml y = new Yaml();\n" +
- " y.load(payload);\n" +
- " return R.ok(\"[+]Java反序列化：SnakeYaml\");\n" +
+ " Object result = y.load(payload);\n" +
+ " return R.ok(\"[+]Java反序列化：SnakeYaml原生漏洞，解析结果：\" + result);\n" +
"}\n" +
"\n" +
"// payload示例\n" +
- "payload=!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ['http://127.0.0.1:7777/yaml-payload.jar']]]]\n"
+ "payload=!!top.whgojp.modules.sqli.entity.Sqli {id: 1, username: test, password: pass}\n"
const safeSnakeYaml = "public R safe(String payload) {\n" +
" try {\n" +
" Yaml y = new Yaml(new SafeConstructor());\n" +
- " y.load(payload);\n" +
- " return R.ok(\"[+]Java反序列化：SnakeYaml安全构造\");\n" +
+ " Object result = y.load(payload);\n" +
+ " return R.ok(\"[+]Java反序列化：SnakeYaml安全构造，解析结果：\" + result);\n" +
" } catch (Exception e) {\n" +
- " return R.error(\"[-]Java反序列化：SnakeYaml反序列化失败\");\n" +
+ " return R.error(\"[-]Java反序列化：SnakeYaml反序列化失败：\" + e.getMessage());\n" +
" }\n" +
- "}"
+"}"
const vulXmlDecoder = 'public R vul(String payload) {\n' +
' String[] strCmd = payload.split(" ");\n' +
@@ -1719,7 +2575,7 @@ const safeFastjson = "public String safe(@RequestBody String content) {\n" +
" // 2、使用AutoType白名单机制\n" +
"// ParserConfig.getGlobalInstance().setAutoTypeSupport(true);\n" +
"// ParserConfig.getGlobalInstance().addAccept(\"top.whgojp.WhiteListClass\");\n" +
- " // 3、1.2.68之后的版本，Fastjson真家里safeMode的支持\n" +
+ " // 3、1.2.68之后的版本，Fastjson增加了safeMode的支持\n" +
"// ParserConfig.getGlobalInstance().setSafeMode(true);\n" +
"// JSONObject jsonObject = JSON.parseObject(content, Feature.DisableSpecialKeyDetect);\n" +
" JSONObject jsonObject = JSON.parseObject(content);\n" +
@@ -1832,3 +2688,24 @@ const vulShiro = "public R getShiroKey(){\n" +
" shiro-spring \n" +
" 1.2.4 \n" +
""
+const JdbcDeserial = "public R jdbc() {\n" +
+ " try (Connection conn = DriverManager.getConnection(url, username, password);\n" +
+ " Statement stmt = conn.createStatement()) {\n" +
+ " ResultSet rs = stmt.executeQuery(\"SELECT malicious_object FROM objects WHERE id = 1\");\n" +
+ " if (rs.next()) {\n" +
+ " byte[] bytes = rs.getBytes(\"malicious_object\");\n" +
+ " try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(bytes))) {\n" +
+ " // 触发反序列化漏洞\n" +
+ " ois.readObject();\n" +
+ " }\n" +
+ " }\n" +
+ " return R.ok(\"触发MYSQL-JDBC反序列化漏洞！\");\n" +
+ " } catch (Exception e) {\n" +
+ " return R.error(\"触发MYSQL-JDBC反序列化漏洞失败：\" + e.getMessage());\n" +
+ " }\n" +
+ "}\n" +
+ "\n" +
+ "private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {\n" +
+ " in.defaultReadObject();\n" +
+ " Runtime.getRuntime().exec(command);\n" +
+ "}"
diff --git a/src/main/resources/static/lib/custom-icon/demo.css b/src/main/resources/static/lib/custom-icon/demo.css
old mode 100644
new mode 100755
diff --git a/src/main/resources/static/lib/custom-icon/demo_index.html b/src/main/resources/static/lib/custom-icon/demo_index.html
old mode 100644
new mode 100755
index ec2a598..d51334c
--- a/src/main/resources/static/lib/custom-icon/demo_index.html
+++ b/src/main/resources/static/lib/custom-icon/demo_index.html
@@ -54,6 +54,84 @@
第二步：定义使用 iconfont 的样式
@@ -446,6 +524,123 @@ 第三步：挑选相应图标并获取字体编码，应用于页面
+
+
+ 流量
+
+ .icon-liuliang1
+
+
+
+
+
+ 流量
+
+ .icon-liuliang
+
+
+
+
+
+ horse-solid
+
+ .icon-horse-solid
+
+
+
+
+
+ 账号
+
+ .icon-zhanghao
+
+
+
+
+
+ 密码找回
+
+ .icon-mimazhaohui
+
+
+
+
+
+ 登录框
+
+ .icon-denglukuang
+
+
+
+
+
+ 高并发
+
+ .icon-gaobingfa
+
+
+
+
+
+ JS
+
+ .icon-JS
+
+
+
+
+
+ 认证绕过
+
+ .icon-renzhengraoguo
+
+
+
+
+
+ 权限伪造
+
+ .icon-quanxianweizao
+
+
+
+
+
+ 短信
+
+ .icon-duanxin
+
+
+
+
+
+ 验证码
+
+ .icon-yanzhengma
+
+
+
+
+
+ 验证码
+
+ .icon-yanzhengma1
+
+
+
@@ -995,6 +1190,110 @@
第二步：挑选相应图标并获取类名，应用于页面：
+
+
+
+ 流量
+ #icon-liuliang1
+
+
+
+
+
+ 流量
+ #icon-liuliang
+
+
+
+
+
+ horse-solid
+ #icon-horse-solid
+
+
+
+
+
+ 账号
+ #icon-zhanghao
+
+
+
+
+
+ 密码找回
+ #icon-mimazhaohui
+
+
+
+
+
+ 登录框
+ #icon-denglukuang
+
+
+
+
+
+ 高并发
+ #icon-gaobingfa
+
+
+
+
+
+ JS
+ #icon-JS
+
+
+
+
+
+ 认证绕过
+ #icon-renzhengraoguo
+
+
+
+
+
+ 权限伪造
+ #icon-quanxianweizao
+
+
+
+
+
+ 短信
+ #icon-duanxin
+
+
+
+
+
+ 验证码
+ #icon-yanzhengma
+
+
+
+
+
+ 验证码
+ #icon-yanzhengma1
+
+
+
+Created by iconfont
+
+
+
+
+
+
diff --git a/src/main/resources/static/lib/layui/font/iconfont.ttf b/src/main/resources/static/lib/layui/font/iconfont.ttf
new file mode 100644
index 0000000..06e30f9
Binary files /dev/null and b/src/main/resources/static/lib/layui/font/iconfont.ttf differ
diff --git a/src/main/resources/static/lib/layui/font/iconfont.woff b/src/main/resources/static/lib/layui/font/iconfont.woff
new file mode 100644
index 0000000..66a1783
Binary files /dev/null and b/src/main/resources/static/lib/layui/font/iconfont.woff differ
diff --git a/src/main/resources/static/lib/layui/font/iconfont.woff2 b/src/main/resources/static/lib/layui/font/iconfont.woff2
new file mode 100644
index 0000000..47e9980
Binary files /dev/null and b/src/main/resources/static/lib/layui/font/iconfont.woff2 differ
diff --git a/src/main/resources/static/lib/layui/layui.js b/src/main/resources/static/lib/layui/layui.js
new file mode 100644
index 0000000..c7e5181
--- /dev/null
+++ b/src/main/resources/static/lib/layui/layui.js
@@ -0,0 +1,5 @@
+/** layui v2.6.3 | Released under the MIT license */
+ ;!function(t){"use strict";var e=document,n={modules:{},status:{},timeout:10,event:{}},r=function(){this.v="2.6.3"},o=function(){var t=e.currentScript?e.currentScript.src:function(){for(var t,n=e.scripts,r=n.length-1,o=r;o>0;o--)if("interactive"===n[o].readyState){t=n[o].src;break}return t||n[r].src}();return t.substring(0,t.lastIndexOf("/")+1)}(),a=function(e,n){n=n||"log",t.console&&console[n]&&console[n]("layui error hint: "+e)},i="undefined"!=typeof opera&&"[object Opera]"===opera.toString(),u=n.builtin={lay:"lay",layer:"layer",laydate:"laydate",laypage:"laypage",laytpl:"laytpl",layedit:"layedit",form:"form",upload:"upload",dropdown:"dropdown",transfer:"transfer",tree:"tree",table:"table",element:"element",rate:"rate",colorpicker:"colorpicker",slider:"slider",carousel:"carousel",flow:"flow",util:"util",code:"code",jquery:"jquery",all:"all","layui.all":"layui.all"};r.prototype.cache=n,r.prototype.define=function(t,e){var r=this,o="function"==typeof t,a=function(){var t=function(t,e){layui[t]=e,n.status[t]=!0};return"function"==typeof e&&e(function(r,o){t(r,o),n.callback[r]=function(){e(t)}}),this};return o&&(e=t,t=[]),r.use(t,a),r},r.prototype.use=function(t,r,l){function c(t,e){var r="PLaySTATION 3"===navigator.platform?/^complete$/:/^(complete|loaded)$/;("load"===t.type||r.test((t.currentTarget||t.srcElement).readyState))&&(n.modules[d]=e,y.removeChild(m),function o(){return++v>1e3*n.timeout/4?a(d+" is not a valid module","error"):void(n.status[d]?s():setTimeout(o,4))}())}function s(){l.push(layui[d]),t.length>1?p.use(t.slice(1),r,l):"function"==typeof r&&function(){return layui.jquery&&"function"==typeof layui.jquery?layui.jquery(function(){r.apply(layui,l)}):void r.apply(layui,l)}()}var p=this,f=n.dir=n.dir?n.dir:o,y=e.getElementsByTagName("head")[0];t=function(){return"string"==typeof t?[t]:"function"==typeof t?(r=t,["all"]):t}();var d=t[0],v=0;if(l=l||[],n.host=n.host||(f.match(/\/\/([\s\S]+?)\//)||["//"+location.host+"/"])[0],0===t.length||layui["layui.all"]&&u[d])return s(),p;var h=(u[d]?f+"modules/":/^\{\/\}/.test(p.modules[d])?"":n.base||"")+(p.modules[d]||d)+".js";if(h=h.replace(/^\{\/\}/,""),!n.modules[d]&&layui[d]&&(n.modules[d]=h),n.modules[d])!function g(){return++v>1e3*n.timeout/4?a(d+" is not a valid module","error"):void("string"==typeof n.modules[d]&&n.status[d]?s():setTimeout(g,4))}();else{var m=e.createElement("script");m.async=!0,m.charset="utf-8",m.src=h+function(){var t=n.version===!0?n.v||(new Date).getTime():n.version||"";return t?"?v="+t:""}(),y.appendChild(m),!m.attachEvent||m.attachEvent.toString&&m.attachEvent.toString().indexOf("[native code")<0||i?m.addEventListener("load",function(t){c(t,h)},!1):m.attachEvent("onreadystatechange",function(t){c(t,h)}),n.modules[d]=h}return p},r.prototype.getStyle=function(e,n){var r=e.currentStyle?e.currentStyle:t.getComputedStyle(e,null);return r[r.getPropertyValue?"getPropertyValue":"getAttribute"](n)},r.prototype.link=function(t,r,o){var i=this,u=e.createElement("link"),l=e.getElementsByTagName("head")[0];"string"==typeof r&&(o=r);var c=(o||t).replace(/\.|\//g,""),s=u.id="layuicss-"+c,p=0;return u.rel="stylesheet",u.href=t+(n.debug?"?v="+(new Date).getTime():""),u.media="all",e.getElementById(s)||l.appendChild(u),"function"!=typeof r?i:(function f(){return++p>1e3*n.timeout/100?a(t+" timeout"):void(1989===parseInt(i.getStyle(e.getElementById(s),"width"))?function(){r()}():setTimeout(f,100))}(),i)},n.callback={},r.prototype.factory=function(t){if(layui[t])return"function"==typeof n.callback[t]?n.callback[t]:null},r.prototype.addcss=function(t,e,r){return layui.link(n.dir+"css/"+t,e,r)},r.prototype.img=function(t,e,n){var r=new Image;return r.src=t,r.complete?e(r):(r.onload=function(){r.onload=null,"function"==typeof e&&e(r)},void(r.onerror=function(t){r.onerror=null,"function"==typeof n&&n(t)}))},r.prototype.config=function(t){t=t||{};for(var e in t)n[e]=t[e];return this},r.prototype.modules=function(){var t={};for(var e in u)t[e]=u[e];return t}(),r.prototype.extend=function(t){var e=this;t=t||{};for(var n in t)e[n]||e.modules[n]?a(n+" Module already exists","error"):e.modules[n]=t[n];return e},r.prototype.router=function(t){var e=this,t=t||location.hash,n={path:[],search:{},hash:(t.match(/[^#](#.*$)/)||[])[1]||""};return/^#\//.test(t)?(t=t.replace(/^#\//,""),n.href="/"+t,t=t.replace(/([^#])(#.*$)/,"$1").split("/")||[],e.each(t,function(t,e){/^\w+=/.test(e)?function(){e=e.split("="),n.search[e[0]]=e[1]}():n.path.push(e)}),n):n},r.prototype.url=function(t){var e=this,n={pathname:function(){var e=t?function(){var e=(t.match(/\.[^.]+?\/.+/)||[])[0]||"";return e.replace(/^[^\/]+/,"").replace(/\?.+/,"")}():location.pathname;return e.replace(/^\//,"").split("/")}(),search:function(){var n={},r=(t?function(){var e=(t.match(/\?.+/)||[])[0]||"";return e.replace(/\#.+/,"")}():location.search).replace(/^\?+/,"").split("&");return e.each(r,function(t,e){var r=e.indexOf("="),o=function(){return r<0?e.substr(0,e.length):0!==r&&e.substr(0,r)}();o&&(n[o]=r>0?e.substr(r+1):null)}),n}(),hash:e.router(function(){return t?(t.match(/#.+/)||[])[0]||"":location.hash}())};return n},r.prototype.data=function(e,n,r){if(e=e||"layui",r=r||localStorage,t.JSON&&t.JSON.parse){if(null===n)return delete r[e];n="object"==typeof n?n:{key:n};try{var o=JSON.parse(r[e])}catch(a){var o={}}return"value"in n&&(o[n.key]=n.value),n.remove&&delete o[n.key],r[e]=JSON.stringify(o),n.key?o[n.key]:o}},r.prototype.sessionData=function(t,e){return this.data(t,e,sessionStorage)},r.prototype.device=function(e){var n=navigator.userAgent.toLowerCase(),r=function(t){var e=new RegExp(t+"/([^\\s\\_\\-]+)");return t=(n.match(e)||[])[1],t||!1},o={os:function(){return/windows/.test(n)?"windows":/linux/.test(n)?"linux":/iphone|ipod|ipad|ios/.test(n)?"ios":/mac/.test(n)?"mac":void 0}(),ie:function(){return!!(t.ActiveXObject||"ActiveXObject"in t)&&((n.match(/msie\s(\d+)/)||[])[1]||"11")}(),weixin:r("micromessenger")};return e&&!o[e]&&(o[e]=r(e)),o.android=/android/.test(n),o.ios="ios"===o.os,o.mobile=!(!o.android&&!o.ios),o},r.prototype.hint=function(){return{error:a}},r.prototype.each=function(t,e){var n,r=this;if("function"!=typeof e)return r;if(t=t||[],t.constructor===Object){for(n in t)if(e.call(t[n],n,t[n]))break}else for(n=0;na?1:o0;o--)if("interactive"===n[o].readyState){t=n[o].src;break}return t||n[r].src}();return t.substring(0,t.lastIndexOf("/")+1)},n.stope=function(t){t=t||window.event,t.stopPropagation?t.stopPropagation():t.cancelBubble=!0},n.each=function(t,e){var n,r=this;if("function"!=typeof e)return r;if(t=t||[],t.constructor===Object){for(n in t)if(e.call(t[n],n,t[n]))break}else for(n=0;n80?window.console&&console.error(u+".css: Invalid"):void(1989===parseInt(n.getStyle(e.getElementById(a),"width"))?r():setTimeout(l,100))}()},n.hasScrollbar=function(){return e.body.scrollHeight>(window.innerHeight||e.documentElement.clientHeight)},n.position=function(t,r,o){if(r){o=o||{},t!==e&&t!==n("body")[0]||(o.clickType="right");var i="right"===o.clickType?function(){var t=o.e||window.event||{};return{left:t.clientX,top:t.clientY,right:t.clientX,bottom:t.clientY}}():t.getBoundingClientRect(),c=r.offsetWidth,u=r.offsetHeight,a=function(t){return t=t?"scrollLeft":"scrollTop",e.body[t]|e.documentElement[t]},s=function(t){return e.documentElement[t?"clientWidth":"clientHeight"]},l=5,f=i.left,p=i.bottom;f+c+l>s("width")&&(f=s("width")-c-l),p+u+l>s()&&(i.top>u+l?p=i.top-u-2*l:"right"===o.clickType&&(p=s()-u-2*l,p<0&&(p=0)));var h=o.position;if(h&&(r.style.position=h),r.style.left=f+("fixed"===h?0:a(1))+"px",r.style.top=p+("fixed"===h?0:a())+"px",!n.hasScrollbar()){var d=r.getBoundingClientRect();!o.SYSTEM_RELOAD&&d.bottom+l>s()&&(o.SYSTEM_RELOAD=!0,setTimeout(function(){n.position(t,r,o)},50))}}},n.options=function(t,e){var r=n(t),o=e||"lay-options";try{return new Function("return "+(r.attr(o)||"{}"))()}catch(i){return hint.error("parseerror："+i,"error"),{}}},n.isTopElem=function(t){var r=[e,n("body")[0]],o=!1;return n.each(r,function(e,n){if(n===t)return o=!0}),o},r.addStr=function(t,e){return t=t.replace(/\s+/," "),e=e.replace(/\s+/," ").split(" "),n.each(e,function(e,n){new RegExp("\\b"+n+"\\b").test(t)||(t=t+" "+n)}),t.replace(/^\s|\s$/,"")},r.removeStr=function(t,e){return t=t.replace(/\s+/," "),e=e.replace(/\s+/," ").split(" "),n.each(e,function(e,n){var r=new RegExp("\\b"+n+"\\b");r.test(t)&&(t=t.replace(r,""))}),t.replace(/\s+/," ").replace(/^\s|\s$/,"")},r.prototype.find=function(t){var e=this,r=0,o=[],i="object"==typeof t;return this.each(function(n,c){for(var u=i?[t]:c.querySelectorAll(t||null);r0)return r[0].style[t]}():r.each(function(r,i){"object"==typeof t?n.each(t,function(t,e){i.style[t]=o(e)}):i.style[t]=o(e)})},r.prototype.width=function(t){var e=this;return void 0===t?function(){if(e.length>0)return e[0].offsetWidth}():e.each(function(n,r){e.css("width",t)})},r.prototype.height=function(t){var e=this;return void 0===t?function(){if(e.length>0)return e[0].offsetHeight}():e.each(function(n,r){e.css("height",t)})},r.prototype.attr=function(t,e){var n=this;return void 0===e?function(){if(n.length>0)return n[0].getAttribute(t)}():n.each(function(n,r){r.setAttribute(t,e)})},r.prototype.removeAttr=function(t){return this.each(function(e,n){n.removeAttribute(t)})},r.prototype.html=function(t){return this.each(function(e,n){n.innerHTML=t})},r.prototype.val=function(t){return this.each(function(e,n){n.value=t})},r.prototype.append=function(t){return this.each(function(e,n){"object"==typeof t?n.appendChild(t):n.innerHTML=n.innerHTML+t})},r.prototype.remove=function(t){return this.each(function(e,n){t?n.removeChild(t):n.parentNode.removeChild(n)})},r.prototype.on=function(t,e){return this.each(function(n,r){r.attachEvent?r.attachEvent("on"+t,function(t){t.target=t.srcElement,e.call(r,t)}):r.addEventListener(t,e,!1)})},r.prototype.off=function(t,e){return this.each(function(n,r){r.detachEvent?r.detachEvent("on"+t,e):r.removeEventListener(t,e,!1)})},window.lay=n,window.layui&&layui.define&&layui.define(function(e){e(t,n)})}();layui.define(function(e){"use strict";var r={open:"{{",close:"}}"},c={exp:function(e){return new RegExp(e,"g")},query:function(e,c,t){var o=["#([\\s\\S])+?","([^{#}])*?"][e||0];return n((c||"")+r.open+o+r.close+(t||""))},escape:function(e){return String(e||"").replace(/&(?!#?[a-zA-Z0-9]+;)/g,"&").replace(//g,">").replace(/'/g,"'").replace(/"/g,""")},error:function(e,r){var c="Laytpl Error: ";return"object"==typeof console&&console.error(c+e+"\n"+(r||"")),c+e}},n=c.exp,t=function(e){this.tpl=e};t.pt=t.prototype,window.errors=0,t.pt.parse=function(e,t){var o=this,p=e,a=n("^"+r.open+"#",""),l=n(r.close+"$","");e=e.replace(/\s+|\r|\t|\n/g," ").replace(n(r.open+"#"),r.open+"# ").replace(n(r.close+"}"),"} "+r.close).replace(/\\/g,"\\\\").replace(n(r.open+"!(.+?)!"+r.close),function(e){return e=e.replace(n("^"+r.open+"!"),"").replace(n("!"+r.close),"").replace(n(r.open+"|"+r.close),function(e){return e.replace(/(.)/g,"\\$ueditor")})}).replace(/(?="|')/g,"\\").replace(c.query(),function(e){return e=e.replace(a,"").replace(l,""),'";'+e.replace(/\\/g,"")+';view+="'}).replace(c.query(1),function(e){var c='"+(';return e.replace(/\s/g,"")===r.open+r.close?"":(e=e.replace(n(r.open+"|"+r.close),""),/^=/.test(e)&&(e=e.replace(/^=/,""),c='"+_escape_('),c+e.replace(/\\/g,"")+')+"')}),e='"use strict";var view = "'+e+'";return view;';try{return o.cache=e=new Function("d, _escape_",e),e(t,c.escape)}catch(u){return delete o.cache,c.error(u,p)}},t.pt.render=function(e,r){var n,t=this;return e?(n=t.cache?t.cache(e,c.escape):t.parse(t.tpl,e),r?void r(n):n):c.error("no data")};var o=function(e){return"string"!=typeof e?c.error("Template not found"):new t(e)};o.config=function(e){e=e||{};for(var c in e)r[c]=e[c]},o.v="ueditor.2.0",e("laytpl",o)});layui.define(function(e){"use strict";var a=document,t="getElementById",n="getElementsByTagName",i="laypage",r="layui-disabled",u=function(e){var a=this;a.config=e||{},a.config.index=++s.index,a.render(!0)};u.prototype.type=function(){var e=this.config;if("object"==typeof e.elem)return void 0===e.elem.length?2:3},u.prototype.view=function(){var e=this,a=e.config,t=a.groups="groups"in a?0|a.groups:5;a.layout="object"==typeof a.layout?a.layout:["prev","page","next"],a.count=0|a.count,a.curr=0|a.curr||1,a.limits="object"==typeof a.limits?a.limits:[10,20,30,40,50],a.limit=0|a.limit||10,a.pages=Math.ceil(a.count/a.limit)||1,a.curr>a.pages&&(a.curr=a.pages),t<0?t=1:t>a.pages&&(t=a.pages),a.prev="prev"in a?a.prev:"上一页",a.next="next"in a?a.next:"下一页";var n=a.pages>t?Math.ceil((a.curr+(t>1?1:0))/(t>0?t:1)):1,i={prev:function(){return a.prev?''+a.prev+" ":""}(),page:function(){var e=[];if(a.count<1)return"";n>1&&a.first!==!1&&0!==t&&e.push(''+(a.first||1)+" ");var i=Math.floor((t-1)/2),r=n>1?a.curr-i:1,u=n>1?function(){var e=a.curr+(t-i-1);return e>a.pages?a.pages:e}():t;for(u-r2&&e.push('… ');r<=u;r++)r===a.curr?e.push('"+r+" '+r+" ");return a.pages>t&&a.pages>u&&a.last!==!1&&(u+1…'),0!==t&&e.push(''+(a.last||a.pages)+" ")),e.join("")}(),next:function(){return a.next?''+a.next+" ":""}(),count:'共 '+a.count+" 条 ",limit:function(){var e=[''];return layui.each(a.limits,function(t,n){e.push('"+n+" 条/页 ")}),e.join("")+" ',' "].join(""),skip:function(){return['到第','确定 '," "].join("")}()};return['',function(){var e=[];return layui.each(a.layout,function(a,t){i[t]&&e.push(i[t])}),e.join("")}(),"
"].join("")},u.prototype.jump=function(e,a){if(e){var t=this,i=t.config,r=e.children,u=e[n]("button")[0],l=e[n]("input")[0],p=e[n]("select")[0],c=function(){var e=0|l.value.replace(/\s|\D/g,"");e&&(i.curr=e,t.render())};if(a)return c();for(var o=0,y=r.length;oi.pages||(i.curr=e,t.render())});p&&s.on(p,"change",function(){var e=this.value;i.curr*e>i.count&&(i.curr=Math.ceil(i.count/e)),i.limit=e,t.render()}),u&&s.on(u,"click",function(){c()})}},u.prototype.skip=function(e){if(e){var a=this,t=e[n]("input")[0];t&&s.on(t,"keyup",function(t){var n=this.value,i=t.keyCode;/^(37|38|39|40)$/.test(i)||(/\D/.test(n)&&(this.value=n.replace(/\D/,"")),13===i&&a.jump(e,!0))})}},u.prototype.render=function(e){var n=this,i=n.config,r=n.type(),u=n.view();2===r?i.elem&&(i.elem.innerHTML=u):3===r?i.elem.html(u):a[t](i.elem)&&(a[t](i.elem).innerHTML=u),i.jump&&i.jump(i,e);var s=a[t]("layui-laypage-"+i.index);n.jump(s),i.hash&&!e&&(location.hash="!"+i.hash+"="+i.curr),n.skip(s)};var s={render:function(e){var a=new u(e);return a.index},index:layui.laypage?layui.laypage.index+1e4:0,on:function(e,a,t){return e.attachEvent?e.attachEvent("on"+a,function(a){a.target=a.srcElement,t.call(e,a)}):e.addEventListener(a,t,!1),this}};e(i,s)});!function(e){"use strict";var t=e.layui&&layui.define,a={getPath:e.lay&&lay.getPath?lay.getPath():"",link:function(t,a,l){n.path&&e.lay&&lay.link&&lay.link(n.path+t,a,l)}},n={v:"5.2.ueditor",config:{},index:e.laydate&&e.laydate.v?1e5:0,path:a.getPath,set:function(e){var t=this;return t.config=lay.extend({},t.config,e),t},ready:function(e){var l="laydate",i="",r=(t?"modules/laydate/":"theme/")+"default/laydate.css?v="+n.v+i;return t?layui.addcss(r,e,l):a.link(r,e,l),this}},l=function(){var e=this;return{hint:function(t){e.hint.call(e,t)},config:e.config}},i="laydate",r=".layui-laydate",o="layui-this",s="laydate-disabled",y=[100,2e5],d="layui-laydate-static",m="layui-laydate-list",c="laydate-selected",u="layui-laydate-hint",h="layui-laydate-footer",f=".laydate-btns-confirm",p="laydate-time-text",g=".laydate-btns-time",v=function(e){var t=this;t.index=++n.index,t.config=lay.extend({},t.config,n.config,e),n.ready(function(){t.init()})};v.isLeapYear=function(e){return e%4===0&&e%100!==0||e%400===0},v.prototype.config={type:"date",range:!1,format:"yyyy-MM-dd",value:null,isInitValue:!0,min:"1900-ueditor-ueditor",max:"2099-12-31",trigger:"click",show:!1,showBottom:!0,btns:["clear","now","confirm"],lang:"cn",theme:"default",position:null,calendar:!1,mark:{},zIndex:null,done:null,change:null},v.prototype.lang=function(){var e=this,t=e.config,a={cn:{weeks:["日","一","二","三","四","五","六"],time:["时","分","秒"],timeTips:"选择时间",startTime:"开始时间",endTime:"结束时间",dateTips:"返回日期",month:["一","二","三","四","五","六","七","八","九","十","十一","十二"],tools:{confirm:"确定",clear:"清空",now:"现在"},timeout:"结束时间不能早于开始时间0)return!0;var n=lay.elem("div",{"class":"layui-laydate-header"}),l=[function(){var e=lay.elem("i",{"class":"layui-icon laydate-icon laydate-prev-y"});return e.innerHTML="",e}(),function(){var e=lay.elem("i",{"class":"layui-icon laydate-icon laydate-prev-m"});return e.innerHTML="",e}(),function(){var e=lay.elem("div",{"class":"laydate-set-ym"}),t=lay.elem("span"),a=lay.elem("span");return e.appendChild(t),e.appendChild(a),e}(),function(){var e=lay.elem("i",{"class":"layui-icon laydate-icon laydate-next-m"});return e.innerHTML="",e}(),function(){var e=lay.elem("i",{"class":"layui-icon laydate-icon laydate-next-y"});return e.innerHTML="",e}()],y=lay.elem("div",{"class":"layui-laydate-content"}),d=lay.elem("table"),m=lay.elem("thead"),c=lay.elem("tr");lay.each(l,function(e,t){n.appendChild(t)}),m.appendChild(c),lay.each(new Array(6),function(e){var t=d.insertRow(0);lay.each(new Array(7),function(n){if(0===e){var l=lay.elem("th");l.innerHTML=a.weeks[n],c.appendChild(l)}t.insertCell(n)})}),d.insertBefore(m,d.children[0]),y.appendChild(d),i[e]=lay.elem("div",{"class":"layui-laydate-main laydate-main-list-"+e}),i[e].appendChild(n),i[e].appendChild(y),r.push(l),o.push(y),s.push(d)}),lay(y).html(function(){var e=[],l=[];return"datetime"===t.type&&e.push(''+a.timeTips+" "),lay.each(t.btns,function(e,i){var r=a.tools[i]||"btn";t.range&&"now"===i||(n&&"clear"===i&&(r="cn"===t.lang?"重置":"Reset"),l.push(''+r+" "))}),e.push('"),e.join("")}()),lay.each(i,function(e,t){l.appendChild(t)}),t.showBottom&&l.appendChild(y),/^#/.test(t.theme)){var m=lay.elem("style"),c=["#{{id}} .layui-laydate-header{background-color:{{theme}};}","#{{id}} .layui-this{background-color:{{theme}} !important;}"].join("").replace(/{{id}}/g,e.elemID).replace(/{{theme}}/g,t.theme);"styleSheet"in m?(m.setAttribute("type","text/css"),m.styleSheet.cssText=c):m.innerHTML=c,lay(l).addClass("laydate-theme-molv"),l.appendChild(m)}e.remove(v.thisElemDate),n?t.elem.append(l):(document.body.appendChild(l),e.position()),e.checkDate().calendar(null,0,"init"),e.changeEvent(),v.thisElemDate=e.elemID,"function"==typeof t.ready&&t.ready(lay.extend({},t.dateTime,{month:t.dateTime.month+1}))},v.prototype.remove=function(e){var t=this,a=(t.config,lay("#"+(e||t.elemID)));return a[0]?(a.hasClass(d)||t.checkDate(function(){a.remove(),delete t.endDate}),t):t},v.prototype.position=function(){var e=this,t=e.config;return lay.position(e.bindElem||t.elem[0],e.elem,{position:t.position}),e},v.prototype.hint=function(e){var t=this,a=(t.config,lay.elem("div",{"class":u}));t.elem&&(a.innerHTML=e||"",lay(t.elem).find("."+u).remove(),t.elem.appendChild(a),clearTimeout(t.hinTimer),t.hinTimer=setTimeout(function(){lay(t.elem).find("."+u).remove()},3e3))},v.prototype.getAsYM=function(e,t,a){return a?t--:t++,t<0&&(t=11,e--),t>11&&(t=0,e++),[e,t]},v.prototype.systemDate=function(e){var t=e||new Date;return{year:t.getFullYear(),month:t.getMonth(),date:t.getDate(),hours:e?e.getHours():0,minutes:e?e.getMinutes():0,seconds:e?e.getSeconds():0}},v.prototype.checkDate=function(e){var t,a,l=this,i=(new Date,l.config),r=l.lang(),o=i.dateTime=i.dateTime||l.systemDate(),s=l.bindElem||i.elem[0],d=(l.isInput(s)?"val":"html",l.isInput(s)?s.value:"static"===i.position?"":s.innerHTML),m=function(e){e.year>y[1]&&(e.year=y[1],a=!0),e.month>11&&(e.month=11,a=!0),e.hours>23&&(e.hours=0,a=!0),e.minutes>59&&(e.minutes=0,e.hours++,a=!0),e.seconds>59&&(e.seconds=0,e.minutes++,a=!0),t=n.getEndDate(e.month+1,e.year),e.date>t&&(e.date=t,a=!0)},c=function(e,t,n){var r=["startTime","endTime"];t=(t.match(l.EXP_SPLIT)||[]).slice(1),n=n||0,i.range&&(l[r[n]]=l[r[n]]||{}),lay.each(l.format,function(o,s){var d=parseFloat(t[o]);t[o].length'+a+""),n},v.prototype.limit=function(e,t,a,n){var l,i=this,r=i.config,o={},y=r[a>41?"endDate":"dateTime"],d=lay.extend({},y,t||{});return lay.each({now:d,min:r.min,max:r.max},function(e,t){o[e]=i.newDate(lay.extend({year:t.year,month:t.month,date:t.date},function(){var e={};return lay.each(n,function(a,n){e[n]=t[n]}),e}())).getTime()}),l=o.nowo.max,e&&e[l?"addClass":"removeClass"](s),l},v.prototype.thisDateTime=function(e){var t=this,a=t.config;return e?t.endDate:a.dateTime},v.prototype.calendar=function(e,t,a){var l,i,r,s=this,d=s.config,t=t?1:0,m=e||s.thisDateTime(t),c=new Date,u=s.lang(),h="date"!==d.type&&"datetime"!==d.type,p=lay(s.table[t]).find("td"),g=lay(s.elemHeader[t][2]).find("span");return m.yeary[1]&&(m.year=y[1],s.hint(u.invalidDate)),s.firstDate||(s.firstDate=lay.extend({},m)),c.setFullYear(m.year,m.month,1),l=c.getDay(),i=n.getEndDate(m.month||12,m.year),r=n.getEndDate(m.month+1,m.year),lay.each(p,function(e,t){var a=[m.year,m.month],n=0;t=lay(t),t.removeAttr("class"),e=l&&e=a.firstDate.year&&(i.month=n.max.month,i.date=n.max.date),a.limit(lay(l),i,t),C++}),lay(c[v?0:1]).attr("lay-ym",C-8+"-"+D[1]).html(w+T+" - "+(C-1+T))}else if("month"===e)lay.each(new Array(12),function(e){var l=lay.elem("li",{"lay-ym":e}),r={year:D[0],month:e};e+1==D[1]&&lay(l).addClass(o),l.innerHTML=i.month[e]+(v?"月":""),y.appendChild(l),D[0]=a.firstDate.year&&(r.date=n.max.date),a.limit(lay(l),r,t)}),lay(c[v?0:1]).attr("lay-ym",D[0]+"-"+D[1]).html(D[0]+T);else if("time"===e){var k=function(){lay(y).find("ol").each(function(e,n){lay(n).find("li").each(function(n,l){a.limit(lay(l),[{hours:n},{hours:a[x].hours,minutes:n},{hours:a[x].hours,minutes:a[x].minutes,seconds:n}][e],t,[["hours"],["hours","minutes"],["hours","minutes","seconds"]][e])})}),n.range||a.limit(lay(a.footer).find(f),a[x],0,["hours","minutes","seconds"])};n.range?a[x]||(a[x]={hours:0,minutes:0,seconds:0}):a[x]=l,lay.each([24,60,60],function(e,t){var n=lay.elem("li"),l=[""+i.time[e]+"
"];lay.each(new Array(t),function(t){l.push(""+lay.digit(t,2)+" ")}),n.innerHTML=l.join("")+"",y.appendChild(n)}),k()}if(h&&u.removeChild(h),u.appendChild(y),"year"===e||"month"===e)lay(a.elemMain[t]).addClass("laydate-ym-show"),lay(y).find("li").on("click",function(){var i=0|lay(this).attr("lay-ym");if(!lay(this).hasClass(s)){0===t?(l[e]=i,a.limit(lay(a.footer).find(f),null,0)):a.endDate[e]=i;var d="year"===n.type||"month"===n.type;d?(lay(y).find("."+o).removeClass(o),lay(this).addClass(o),"month"===n.type&&"year"===e&&(a.listYM[t][0]=i,r&&(t?l.year=i:a.endDate.year=i),a.list("month",t))):(a.checkDate("limit").calendar(null,t),a.closeList()),a.setBtnStatus(),n.range||(("month"===n.type&&"month"===e||"year"===n.type&&"year"===e)&&a.setValue(a.parse()).remove().done(),a.done(null,"change")),lay(a.footer).find(g).removeClass(s)}});else{var E=lay.elem("span",{"class":p}),b=function(){lay(y).find("ol").each(function(e){var t=this,n=lay(t).find("li");t.scrollTop=30*(a[x][M[e]]-2),t.scrollTop<=0&&n.each(function(e,a){if(!lay(this).hasClass(s))return t.scrollTop=30*(e-2),!0})})},H=lay(d[2]).find("."+p);b(),E.innerHTML=n.range?[i.startTime,i.endTime][t]:i.timeTips,lay(a.elemMain[t]).addClass("laydate-time-show"),H[0]&&H.remove(),d[2].appendChild(E),lay(y).find("ol").each(function(e){var t=this;lay(t).find("li").on("click",function(){var i=0|this.innerHTML;lay(this).hasClass(s)||(n.range?a[x][M[e]]=i:l[M[e]]=i,lay(t).find("."+o).removeClass(o),lay(this).addClass(o),k(),b(),(a.endDate||"time"===n.type)&&a.done(null,"change"),a.setBtnStatus())})})}return a},v.prototype.listYM=[],v.prototype.closeList=function(){var e=this;e.config;lay.each(e.elemCont,function(t,a){lay(this).find("."+m).remove(),lay(e.elemMain[t]).removeClass("laydate-ym-show laydate-time-show")}),lay(e.elem).find("."+p).remove()},v.prototype.setBtnStatus=function(e,t,a){var n,l=this,i=l.config,r=l.lang(),o=lay(l.footer).find(f);i.range&&"time"!==i.type&&(t=t||i.dateTime,a=a||l.endDate,n=l.newDate(t).getTime()>l.newDate(a).getTime(),l.limit(null,t)||l.limit(null,a)?o.addClass(s):o[n?"addClass":"removeClass"](s),e&&n&&l.hint("string"==typeof e?r.timeout.replace(/日期/g,e):r.timeout))},v.prototype.parse=function(e,t){var a=this,n=a.config,l=t||(e?lay.extend({},a.endDate,a.endTime):n.range?lay.extend({},n.dateTime,a.startTime):n.dateTime),i=a.format.concat();return lay.each(i,function(e,t){/yyyy|y/.test(t)?i[e]=lay.digit(l.year,t.length):/MM|M/.test(t)?i[e]=lay.digit(l.month+1,t.length):/dd|d/.test(t)?i[e]=lay.digit(l.date,t.length):/HH|H/.test(t)?i[e]=lay.digit(l.hours,t.length):/mm|m/.test(t)?i[e]=lay.digit(l.minutes,t.length):/ss|s/.test(t)&&(i[e]=lay.digit(l.seconds,t.length))}),n.range&&!e?i.join("")+" "+n.range+" "+a.parse(1):i.join("")},v.prototype.newDate=function(e){return e=e||{},new Date(e.year||1,e.month||0,e.date||1,e.hours||0,e.minutes||0,e.seconds||0)},v.prototype.setValue=function(e){var t=this,a=t.config,n=t.bindElem||a.elem[0],l=t.isInput(n)?"val":"html";return"static"===a.position||lay(n)[l](e||""),this},v.prototype.stampRange=function(e,t){var a,n,l=this,i=l.config;i.range&&(a=l.newDate(i.dateTime).getTime(),n=l.newDate(l.endDate).getTime(),lay.each(t,function(t,i){var r=lay(i).attr("lay-ymd").split("-"),o=l.newDate({year:r[0],month:r[1]-1,date:r[2]}).getTime();0==e?o>a&&lay(i).addClass(c):o0&&t-1 in e)}function r(e,t,n){if(pe.isFunction(t))return pe.grep(e,function(e,r){return!!t.call(e,r,e)!==n});if(t.nodeType)return pe.grep(e,function(e){return e===t!==n});if("string"==typeof t){if(Ce.test(t))return pe.filter(t,e,n);t=pe.filter(t,e)}return pe.grep(e,function(e){return pe.inArray(e,t)>-1!==n})}function i(e,t){do e=e[t];while(e&&1!==e.nodeType);return e}function o(e){var t={};return pe.each(e.match(De)||[],function(e,n){t[n]=!0}),t}function a(){re.addEventListener?(re.removeEventListener("DOMContentLoaded",s),e.removeEventListener("load",s)):(re.detachEvent("onreadystatechange",s),e.detachEvent("onload",s))}function s(){(re.addEventListener||"load"===e.event.type||"complete"===re.readyState)&&(a(),pe.ready())}function u(e,t,n){if(void 0===n&&1===e.nodeType){var r="data-"+t.replace(_e,"-$ueditor").toLowerCase();if(n=e.getAttribute(r),"string"==typeof n){try{n="true"===n||"false"!==n&&("null"===n?null:+n+""===n?+n:qe.test(n)?pe.parseJSON(n):n)}catch(i){}pe.data(e,t,n)}else n=void 0}return n}function l(e){var t;for(t in e)if(("data"!==t||!pe.isEmptyObject(e[t]))&&"toJSON"!==t)return!1;return!0}function c(e,t,n,r){if(He(e)){var i,o,a=pe.expando,s=e.nodeType,u=s?pe.cache:e,l=s?e[a]:e[a]&&a;if(l&&u[l]&&(r||u[l].data)||void 0!==n||"string"!=typeof t)return l||(l=s?e[a]=ne.pop()||pe.guid++:a),u[l]||(u[l]=s?{}:{toJSON:pe.noop}),"object"!=typeof t&&"function"!=typeof t||(r?u[l]=pe.extend(u[l],t):u[l].data=pe.extend(u[l].data,t)),o=u[l],r||(o.data||(o.data={}),o=o.data),void 0!==n&&(o[pe.camelCase(t)]=n),"string"==typeof t?(i=o[t],null==i&&(i=o[pe.camelCase(t)])):i=o,i}}function f(e,t,n){if(He(e)){var r,i,o=e.nodeType,a=o?pe.cache:e,s=o?e[pe.expando]:pe.expando;if(a[s]){if(t&&(r=n?a[s]:a[s].data)){pe.isArray(t)?t=t.concat(pe.map(t,pe.camelCase)):t in r?t=[t]:(t=pe.camelCase(t),t=t in r?[t]:t.split(" ")),i=t.length;for(;i--;)delete r[t[i]];if(n?!l(r):!pe.isEmptyObject(r))return}(n||(delete a[s].data,l(a[s])))&&(o?pe.cleanData([e],!0):fe.deleteExpando||a!=a.window?delete a[s]:a[s]=void 0)}}}function d(e,t,n,r){var i,o=1,a=20,s=r?function(){return r.cur()}:function(){return pe.css(e,t,"")},u=s(),l=n&&n[3]||(pe.cssNumber[t]?"":"px"),c=(pe.cssNumber[t]||"px"!==l&&+u)&&Me.exec(pe.css(e,t));if(c&&c[3]!==l){l=l||c[3],n=n||[],c=+u||1;do o=o||".5",c/=o,pe.style(e,t,c+l);while(o!==(o=s()/u)&&1!==o&&--a)}return n&&(c=+c||+u||0,i=n[1]?c+(n[1]+1)*n[2]:+n[2],r&&(r.unit=l,r.start=c,r.end=i)),i}function p(e){var t=ze.split("|"),n=e.createDocumentFragment();if(n.createElement)for(;t.length;)n.createElement(t.pop());return n}function h(e,t){var n,r,i=0,o="undefined"!=typeof e.getElementsByTagName?e.getElementsByTagName(t||"*"):"undefined"!=typeof e.querySelectorAll?e.querySelectorAll(t||"*"):void 0;if(!o)for(o=[],n=e.childNodes||e;null!=(r=n[i]);i++)!t||pe.nodeName(r,t)?o.push(r):pe.merge(o,h(r,t));return void 0===t||t&&pe.nodeName(e,t)?pe.merge([e],o):o}function g(e,t){for(var n,r=0;null!=(n=e[r]);r++)pe._data(n,"globalEval",!t||pe._data(t[r],"globalEval"))}function m(e){Be.test(e.type)&&(e.defaultChecked=e.checked)}function y(e,t,n,r,i){for(var o,a,s,u,l,c,f,d=e.length,y=p(t),v=[],x=0;x"!==f[1]||Ve.test(a)?0:u:u.firstChild,o=a&&a.childNodes.length;o--;)pe.nodeName(c=a.childNodes[o],"tbody")&&!c.childNodes.length&&a.removeChild(c);for(pe.merge(v,u.childNodes),u.textContent="";u.firstChild;)u.removeChild(u.firstChild);u=y.lastChild}else v.push(t.createTextNode(a));for(u&&y.removeChild(u),fe.appendChecked||pe.grep(h(v,"input"),m),x=0;a=v[x++];)if(r&&pe.inArray(a,r)>-1)i&&i.push(a);else if(s=pe.contains(a.ownerDocument,a),u=h(y.appendChild(a),"script"),s&&g(u),n)for(o=0;a=u[o++];)Ie.test(a.type||"")&&n.push(a);return u=null,y}function v(){return!0}function x(){return!1}function b(){try{return re.activeElement}catch(e){}}function w(e,t,n,r,i,o){var a,s;if("object"==typeof t){"string"!=typeof n&&(r=r||n,n=void 0);for(s in t)w(e,s,n,r,t[s],o);return e}if(null==r&&null==i?(i=n,r=n=void 0):null==i&&("string"==typeof n?(i=r,r=void 0):(i=r,r=n,n=void 0)),i===!1)i=x;else if(!i)return e;return 1===o&&(a=i,i=function(e){return pe().off(e),a.apply(this,arguments)},i.guid=a.guid||(a.guid=pe.guid++)),e.each(function(){pe.event.add(this,t,i,r,n)})}function T(e,t){return pe.nodeName(e,"table")&&pe.nodeName(11!==t.nodeType?t:t.firstChild,"tr")?e.getElementsByTagName("tbody")[0]||e.appendChild(e.ownerDocument.createElement("tbody")):e}function C(e){return e.type=(null!==pe.find.attr(e,"type"))+"/"+e.type,e}function E(e){var t=it.exec(e.type);return t?e.type=t[1]:e.removeAttribute("type"),e}function N(e,t){if(1===t.nodeType&&pe.hasData(e)){var n,r,i,o=pe._data(e),a=pe._data(t,o),s=o.events;if(s){delete a.handle,a.events={};for(n in s)for(r=0,i=s[n].length;r1&&"string"==typeof p&&!fe.checkClone&&rt.test(p))return e.each(function(i){var o=e.eq(i);g&&(t[0]=p.call(this,i,o.html())),S(o,t,n,r)});if(f&&(l=y(t,e[0].ownerDocument,!1,e,r),i=l.firstChild,1===l.childNodes.length&&(l=i),i||r)){for(s=pe.map(h(l,"script"),C),a=s.length;c=0&&n=0},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},isPlainObject:function(e){var t;if(!e||"object"!==pe.type(e)||e.nodeType||pe.isWindow(e))return!1;try{if(e.constructor&&!ce.call(e,"constructor")&&!ce.call(e.constructor.prototype,"isPrototypeOf"))return!1}catch(n){return!1}if(!fe.ownFirst)for(t in e)return ce.call(e,t);for(t in e);return void 0===t||ce.call(e,t)},type:function(e){return null==e?e+"":"object"==typeof e||"function"==typeof e?ue[le.call(e)]||"object":typeof e},globalEval:function(t){t&&pe.trim(t)&&(e.execScript||function(t){e.eval.call(e,t)})(t)},camelCase:function(e){return e.replace(ge,"ms-").replace(me,ye)},nodeName:function(e,t){return e.nodeName&&e.nodeName.toLowerCase()===t.toLowerCase()},each:function(e,t){var r,i=0;if(n(e))for(r=e.length;iT.cacheLength&&delete e[t.shift()],e[n+" "]=r}var t=[];return e}function r(e){return e[P]=!0,e}function i(e){var t=H.createElement("div");try{return!!e(t)}catch(n){return!1}finally{t.parentNode&&t.parentNode.removeChild(t),t=null}}function o(e,t){for(var n=e.split("|"),r=n.length;r--;)T.attrHandle[n[r]]=t}function a(e,t){var n=t&&e,r=n&&1===e.nodeType&&1===t.nodeType&&(~t.sourceIndex||V)-(~e.sourceIndex||V);if(r)return r;if(n)for(;n=n.nextSibling;)if(n===t)return-1;return e?1:-1}function s(e){return function(t){var n=t.nodeName.toLowerCase();return"input"===n&&t.type===e}}function u(e){return function(t){var n=t.nodeName.toLowerCase();return("input"===n||"button"===n)&&t.type===e}}function l(e){return r(function(t){return t=+t,r(function(n,r){for(var i,o=e([],n.length,t),a=o.length;a--;)n[i=o[a]]&&(n[i]=!(r[i]=n[i]))})})}function c(e){return e&&"undefined"!=typeof e.getElementsByTagName&&e}function f(){}function d(e){for(var t=0,n=e.length,r="";t1?function(t,n,r){for(var i=e.length;i--;)if(!e[i](t,n,r))return!1;return!0}:e[0]}function g(e,n,r){for(var i=0,o=n.length;i-1&&(r[l]=!(a[l]=f))}}else x=m(x===a?x.splice(h,x.length):x),o?o(null,a,x,u):Q.apply(a,x)})}function v(e){for(var t,n,r,i=e.length,o=T.relative[e[0].type],a=o||T.relative[" "],s=o?1:0,u=p(function(e){return e===t},a,!0),l=p(function(e){return ee(t,e)>-1},a,!0),c=[function(e,n,r){var i=!o&&(r||n!==A)||((t=n).nodeType?u(e,n,r):l(e,n,r));return t=null,i}];s1&&h(c),s>1&&d(e.slice(0,s-1).concat({value:" "===e[s-2].type?"*":""})).replace(se,"$1"),n,s0,o=e.length>0,a=function(r,a,s,u,l){var c,f,d,p=0,h="0",g=r&&[],y=[],v=A,x=r||o&&T.find.TAG("*",l),b=W+=null==v?1:Math.random()||.1,w=x.length;for(l&&(A=a===H||a||l);h!==w&&null!=(c=x[h]);h++){if(o&&c){for(f=0,a||c.ownerDocument===H||(L(c),s=!_);d=e[f++];)if(d(c,a||H,s)){u.push(c);break}l&&(W=b)}i&&((c=!d&&c)&&p--,r&&g.push(c))}if(p+=h,i&&h!==p){for(f=0;d=n[f++];)d(g,y,a,s);if(r){if(p>0)for(;h--;)g[h]||y[h]||(y[h]=G.call(u));y=m(y)}Q.apply(u,y),l&&!r&&y.length>0&&p+n.length>1&&t.uniqueSort(u)}return l&&(W=b,A=v),g};return i?r(a):a}var b,w,T,C,E,N,k,S,A,D,j,L,H,q,_,F,M,O,R,P="sizzle"+1*new Date,B=e.document,W=0,I=0,$=n(),z=n(),X=n(),U=function(e,t){return e===t&&(j=!0),0},V=1<<31,Y={}.hasOwnProperty,J=[],G=J.pop,K=J.push,Q=J.push,Z=J.slice,ee=function(e,t){for(var n=0,r=e.length;n+~]|"+ne+")"+ne+"*"),ce=new RegExp("="+ne+"*([^\\]'\"]*?)"+ne+"*\\]","g"),fe=new RegExp(oe),de=new RegExp("^"+re+"$"),pe={ID:new RegExp("^#("+re+")"),CLASS:new RegExp("^\\.("+re+")"),TAG:new RegExp("^("+re+"|[*])"),ATTR:new RegExp("^"+ie),PSEUDO:new RegExp("^"+oe),CHILD:new RegExp("^:(only|first|last|nth|nth-last)-(child|of-type)(?:\\("+ne+"*(even|odd|(([+-]|)(\\d*)n|)"+ne+"*(?:([+-]|)"+ne+"*(\\d+)|))"+ne+"*\\)|)","i"),bool:new RegExp("^(?:"+te+")$","i"),needsContext:new RegExp("^"+ne+"*[>+~]|:(even|odd|eq|gt|lt|nth|first|last)(?:\\("+ne+"*((?:-\\d)?\\d*)"+ne+"*\\)|)(?=[^-]|$)","i")},he=/^(?:input|select|textarea|button)$/i,ge=/^h\d$/i,me=/^[^{]+\{\s*\[native \w/,ye=/^(?:#([\w-]+)|(\w+)|\.([\w-]+))$/,ve=/[+~]/,xe=/'|\\/g,be=new RegExp("\\\\([\\da-f]{ueditor,6}"+ne+"?|("+ne+")|.)","ig"),we=function(e,t,n){var r="0x"+t-65536;return r!==r||n?t:r<0?String.fromCharCode(r+65536):String.fromCharCode(r>>10|55296,1023&r|56320)},Te=function(){L()};try{Q.apply(J=Z.call(B.childNodes),B.childNodes),J[B.childNodes.length].nodeType}catch(Ce){Q={apply:J.length?function(e,t){K.apply(e,Z.call(t))}:function(e,t){for(var n=e.length,r=0;e[n++]=t[r++];);e.length=n-1}}}w=t.support={},E=t.isXML=function(e){var t=e&&(e.ownerDocument||e).documentElement;return!!t&&"HTML"!==t.nodeName},L=t.setDocument=function(e){var t,n,r=e?e.ownerDocument||e:B;return r!==H&&9===r.nodeType&&r.documentElement?(H=r,q=H.documentElement,_=!E(H),(n=H.defaultView)&&n.top!==n&&(n.addEventListener?n.addEventListener("unload",Te,!1):n.attachEvent&&n.attachEvent("onunload",Te)),w.attributes=i(function(e){return e.className="i",!e.getAttribute("className")}),w.getElementsByTagName=i(function(e){return e.appendChild(H.createComment("")),!e.getElementsByTagName("*").length}),w.getElementsByClassName=me.test(H.getElementsByClassName),w.getById=i(function(e){return q.appendChild(e).id=P,!H.getElementsByName||!H.getElementsByName(P).length}),w.getById?(T.find.ID=function(e,t){if("undefined"!=typeof t.getElementById&&_){var n=t.getElementById(e);return n?[n]:[]}},T.filter.ID=function(e){var t=e.replace(be,we);return function(e){return e.getAttribute("id")===t}}):(delete T.find.ID,T.filter.ID=function(e){var t=e.replace(be,we);return function(e){var n="undefined"!=typeof e.getAttributeNode&&e.getAttributeNode("id");return n&&n.value===t}}),T.find.TAG=w.getElementsByTagName?function(e,t){return"undefined"!=typeof t.getElementsByTagName?t.getElementsByTagName(e):w.qsa?t.querySelectorAll(e):void 0}:function(e,t){var n,r=[],i=0,o=t.getElementsByTagName(e);if("*"===e){for(;n=o[i++];)1===n.nodeType&&r.push(n);return r}return o},T.find.CLASS=w.getElementsByClassName&&function(e,t){if("undefined"!=typeof t.getElementsByClassName&&_)return t.getElementsByClassName(e)},M=[],F=[],(w.qsa=me.test(H.querySelectorAll))&&(i(function(e){q.appendChild(e).innerHTML="=0;)e.push(r);return e}),gt:l(function(e,t,n){for(var r=n<0?n+t:n;++r2&&"ID"===(a=o[0]).type&&w.getById&&9===t.nodeType&&_&&T.relative[o[1].type]){if(t=(T.find.ID(a.matches[0].replace(be,we),t)||[])[0],!t)return n;l&&(t=t.parentNode),e=e.slice(o.shift().value.length)}for(i=pe.needsContext.test(e)?0:o.length;i--&&(a=o[i],!T.relative[s=a.type]);)if((u=T.find[s])&&(r=u(a.matches[0].replace(be,we),ve.test(o[0].type)&&c(t.parentNode)||t))){if(o.splice(i,1),e=r.length&&d(o),!e)return Q.apply(n,r),n;break}}return(l||k(e,f))(r,t,!_,n,!t||ve.test(e)&&c(t.parentNode)||t),n},w.sortStable=P.split("").sort(U).join("")===P,w.detectDuplicates=!!j,L(),w.sortDetached=i(function(e){return 1&e.compareDocumentPosition(H.createElement("div"))}),i(function(e){return e.innerHTML="1?pe.unique(n):n),n.selector=this.selector?this.selector+" "+e:e,n},filter:function(e){return this.pushStack(r(this,e||[],!1))},not:function(e){return this.pushStack(r(this,e||[],!0))},is:function(e){return!!r(this,"string"==typeof e&&we.test(e)?pe(e):e||[],!1).length}});var Ee,Ne=/^(?:\s*(<[\w\W]+>)[^>]*|#([\w-]*))$/,ke=pe.fn.init=function(e,t,n){var r,i;if(!e)return this;if(n=n||Ee,"string"==typeof e){if(r="<"===e.charAt(0)&&">"===e.charAt(e.length-1)&&e.length>=3?[null,e,null]:Ne.exec(e),!r||!r[1]&&t)return!t||t.jquery?(t||n).find(e):this.constructor(t).find(e);if(r[1]){if(t=t instanceof pe?t[0]:t,pe.merge(this,pe.parseHTML(r[1],t&&t.nodeType?t.ownerDocument||t:re,!0)),Te.test(r[1])&&pe.isPlainObject(t))for(r in t)pe.isFunction(this[r])?this[r](t[r]):this.attr(r,t[r]);return this}if(i=re.getElementById(r[2]),i&&i.parentNode){if(i.id!==r[2])return Ee.find(e);this.length=1,this[0]=i}return this.context=re,this.selector=e,this}return e.nodeType?(this.context=this[0]=e,this.length=1,this):pe.isFunction(e)?"undefined"!=typeof n.ready?n.ready(e):e(pe):(void 0!==e.selector&&(this.selector=e.selector,this.context=e.context),pe.makeArray(e,this))};ke.prototype=pe.fn,Ee=pe(re);var Se=/^(?:parents|prev(?:Until|All))/,Ae={children:!0,contents:!0,next:!0,prev:!0};pe.fn.extend({has:function(e){var t,n=pe(e,this),r=n.length;return this.filter(function(){for(t=0;t-1:1===n.nodeType&&pe.find.matchesSelector(n,e))){o.push(n);break}return this.pushStack(o.length>1?pe.uniqueSort(o):o)},index:function(e){return e?"string"==typeof e?pe.inArray(this[0],pe(e)):pe.inArray(e.jquery?e[0]:e,this):this[0]&&this[0].parentNode?this.first().prevAll().length:-1},add:function(e,t){return this.pushStack(pe.uniqueSort(pe.merge(this.get(),pe(e,t))))},addBack:function(e){return this.add(null==e?this.prevObject:this.prevObject.filter(e))}}),pe.each({parent:function(e){var t=e.parentNode;return t&&11!==t.nodeType?t:null},parents:function(e){return xe(e,"parentNode")},parentsUntil:function(e,t,n){return xe(e,"parentNode",n)},next:function(e){return i(e,"nextSibling")},prev:function(e){return i(e,"previousSibling")},nextAll:function(e){return xe(e,"nextSibling")},prevAll:function(e){return xe(e,"previousSibling")},nextUntil:function(e,t,n){return xe(e,"nextSibling",n)},prevUntil:function(e,t,n){return xe(e,"previousSibling",n)},siblings:function(e){return be((e.parentNode||{}).firstChild,e)},children:function(e){return be(e.firstChild)},contents:function(e){return pe.nodeName(e,"iframe")?e.contentDocument||e.contentWindow.document:pe.merge([],e.childNodes)}},function(e,t){pe.fn[e]=function(n,r){var i=pe.map(this,t,n);return"Until"!==e.slice(-5)&&(r=n),r&&"string"==typeof r&&(i=pe.filter(r,i)),this.length>1&&(Ae[e]||(i=pe.uniqueSort(i)),Se.test(e)&&(i=i.reverse())),this.pushStack(i)}});var De=/\S+/g;pe.Callbacks=function(e){e="string"==typeof e?o(e):pe.extend({},e);var t,n,r,i,a=[],s=[],u=-1,l=function(){for(i=e.once,r=t=!0;s.length;u=-1)for(n=s.shift();++u-1;)a.splice(n,1),n<=u&&u--}),this},has:function(e){return e?pe.inArray(e,a)>-1:a.length>0},empty:function(){return a&&(a=[]),this},disable:function(){return i=s=[],a=n="",this},disabled:function(){return!a},lock:function(){return i=!0,n||c.disable(),this},locked:function(){return!!i},fireWith:function(e,n){return i||(n=n||[],n=[e,n.slice?n.slice():n],s.push(n),t||l()),this},fire:function(){return c.fireWith(this,arguments),this},fired:function(){return!!r}};return c},pe.extend({Deferred:function(e){var t=[["resolve","done",pe.Callbacks("once memory"),"resolved"],["reject","fail",pe.Callbacks("once memory"),"rejected"],["notify","progress",pe.Callbacks("memory")]],n="pending",r={state:function(){return n},always:function(){return i.done(arguments).fail(arguments),this},then:function(){var e=arguments;return pe.Deferred(function(n){pe.each(t,function(t,o){var a=pe.isFunction(e[t])&&e[t];i[o[1]](function(){var e=a&&a.apply(this,arguments);e&&pe.isFunction(e.promise)?e.promise().progress(n.notify).done(n.resolve).fail(n.reject):n[o[0]+"With"](this===r?n.promise():this,a?[e]:arguments)})}),e=null}).promise()},promise:function(e){return null!=e?pe.extend(e,r):r}},i={};return r.pipe=r.then,pe.each(t,function(e,o){var a=o[2],s=o[3];r[o[1]]=a.add,s&&a.add(function(){n=s},t[1^e][2].disable,t[2][2].lock),i[o[0]]=function(){return i[o[0]+"With"](this===i?r:this,arguments),this},i[o[0]+"With"]=a.fireWith}),r.promise(i),e&&e.call(i,i),i},when:function(e){var t,n,r,i=0,o=ie.call(arguments),a=o.length,s=1!==a||e&&pe.isFunction(e.promise)?a:0,u=1===s?e:pe.Deferred(),l=function(e,n,r){return function(i){n[e]=this,r[e]=arguments.length>1?ie.call(arguments):i,r===t?u.notifyWith(n,r):--s||u.resolveWith(n,r)}};if(a>1)for(t=new Array(a),n=new Array(a),r=new Array(a);i0||(je.resolveWith(re,[pe]),pe.fn.triggerHandler&&(pe(re).triggerHandler("ready"),pe(re).off("ready"))))}}),pe.ready.promise=function(t){if(!je)if(je=pe.Deferred(),"complete"===re.readyState||"loading"!==re.readyState&&!re.documentElement.doScroll)e.setTimeout(pe.ready);else if(re.addEventListener)re.addEventListener("DOMContentLoaded",s),e.addEventListener("load",s);else{re.attachEvent("onreadystatechange",s),e.attachEvent("onload",s);var n=!1;try{n=null==e.frameElement&&re.documentElement}catch(r){}n&&n.doScroll&&!function i(){if(!pe.isReady){try{n.doScroll("left")}catch(t){return e.setTimeout(i,50)}a(),pe.ready()}}()}return je.promise(t)},pe.ready.promise();var Le;for(Le in pe(fe))break;fe.ownFirst="0"===Le,fe.inlineBlockNeedsLayout=!1,pe(function(){var e,t,n,r;n=re.getElementsByTagName("body")[0],n&&n.style&&(t=re.createElement("div"),r=re.createElement("div"),r.style.cssText="position:absolute;border:0;width:0;height:0;top:0;left:-9999px",n.appendChild(r).appendChild(t),"undefined"!=typeof t.style.zoom&&(t.style.cssText="display:inline;margin:0;border:0;padding:1px;width:1px;zoom:ueditor",fe.inlineBlockNeedsLayout=e=3===t.offsetWidth,e&&(n.style.zoom=1)),n.removeChild(r))}),function(){var e=re.createElement("div");fe.deleteExpando=!0;try{delete e.test}catch(t){fe.deleteExpando=!1}e=null}();var He=function(e){var t=pe.noData[(e.nodeName+" ").toLowerCase()],n=+e.nodeType||1;return(1===n||9===n)&&(!t||t!==!0&&e.getAttribute("classid")===t)},qe=/^(?:\{[\w\W]*\}|\[[\w\W]*\])$/,_e=/([A-Z])/g;pe.extend({cache:{},noData:{"applet ":!0,"embed ":!0,"object ":"clsid:D27CDB6E-AE6D-11cf-96B8-444553540000"},hasData:function(e){return e=e.nodeType?pe.cache[e[pe.expando]]:e[pe.expando],!!e&&!l(e)},data:function(e,t,n){return c(e,t,n)},removeData:function(e,t){return f(e,t)},_data:function(e,t,n){return c(e,t,n,!0)},_removeData:function(e,t){return f(e,t,!0)}}),pe.fn.extend({data:function(e,t){var n,r,i,o=this[0],a=o&&o.attributes;if(void 0===e){if(this.length&&(i=pe.data(o),1===o.nodeType&&!pe._data(o,"parsedAttrs"))){for(n=a.length;n--;)a[n]&&(r=a[n].name,0===r.indexOf("data-")&&(r=pe.camelCase(r.slice(5)),u(o,r,i[r])));pe._data(o,"parsedAttrs",!0)}return i}return"object"==typeof e?this.each(function(){pe.data(this,e)}):arguments.length>1?this.each(function(){pe.data(this,e,t)}):o?u(o,e,pe.data(o,e)):void 0},removeData:function(e){return this.each(function(){pe.removeData(this,e)})}}),pe.extend({queue:function(e,t,n){var r;if(e)return t=(t||"fx")+"queue",r=pe._data(e,t),n&&(!r||pe.isArray(n)?r=pe._data(e,t,pe.makeArray(n)):r.push(n)),r||[]},dequeue:function(e,t){t=t||"fx";var n=pe.queue(e,t),r=n.length,i=n.shift(),o=pe._queueHooks(e,t),a=function(){pe.dequeue(e,t)};"inprogress"===i&&(i=n.shift(),r--),i&&("fx"===t&&n.unshift("inprogress"),delete o.stop,i.call(e,a,o)),!r&&o&&o.empty.fire()},_queueHooks:function(e,t){var n=t+"queueHooks";return pe._data(e,n)||pe._data(e,n,{empty:pe.Callbacks("once memory").add(function(){pe._removeData(e,t+"queue"),pe._removeData(e,n)})})}}),pe.fn.extend({queue:function(e,t){var n=2;return"string"!=typeof e&&(t=e,e="fx",n--),arguments.lengtha "," "],legend:[1,""," "],area:[1,""," "],param:[1,""," "],thead:[1,""],tr:[2,""],col:[2,""],td:[3,""],_default:fe.htmlSerialize?[0,"",""]:[1,"X","
"]};Xe.optgroup=Xe.option,Xe.tbody=Xe.tfoot=Xe.colgroup=Xe.caption=Xe.thead,Xe.th=Xe.td;var Ue=/<|&#?\w+;/,Ve=/-1&&(h=p.split("."),p=h.shift(),h.sort()),a=p.indexOf(":")<0&&"on"+p,t=t[pe.expando]?t:new pe.Event(p,"object"==typeof t&&t),t.isTrigger=i?2:3,t.namespace=h.join("."),t.rnamespace=t.namespace?new RegExp("(^|\\.)"+h.join("\\.(?:.*\\.|)")+"(\\.|$)"):null,t.result=void 0,t.target||(t.target=r),n=null==n?[t]:pe.makeArray(n,[t]),l=pe.event.special[p]||{},i||!l.trigger||l.trigger.apply(r,n)!==!1)){if(!i&&!l.noBubble&&!pe.isWindow(r)){for(u=l.delegateType||p,Ke.test(u+p)||(s=s.parentNode);s;s=s.parentNode)d.push(s),c=s;c===(r.ownerDocument||re)&&d.push(c.defaultView||c.parentWindow||e)}for(f=0;(s=d[f++])&&!t.isPropagationStopped();)t.type=f>1?u:l.bindType||p,o=(pe._data(s,"events")||{})[t.type]&&pe._data(s,"handle"),o&&o.apply(s,n),o=a&&s[a],o&&o.apply&&He(s)&&(t.result=o.apply(s,n),t.result===!1&&t.preventDefault());if(t.type=p,!i&&!t.isDefaultPrevented()&&(!l._default||l._default.apply(d.pop(),n)===!1)&&He(r)&&a&&r[p]&&!pe.isWindow(r)){c=r[a],c&&(r[a]=null),pe.event.triggered=p;try{r[p]()}catch(g){}pe.event.triggered=void 0,c&&(r[a]=c)}return t.result}},dispatch:function(e){e=pe.event.fix(e);var t,n,r,i,o,a=[],s=ie.call(arguments),u=(pe._data(this,"events")||{})[e.type]||[],l=pe.event.special[e.type]||{};if(s[0]=e,e.delegateTarget=this,!l.preDispatch||l.preDispatch.call(this,e)!==!1){for(a=pe.event.handlers.call(this,e,u),t=0;(i=a[t++])&&!e.isPropagationStopped();)for(e.currentTarget=i.elem,n=0;(o=i.handlers[n++])&&!e.isImmediatePropagationStopped();)e.rnamespace&&!e.rnamespace.test(o.namespace)||(e.handleObj=o,e.data=o.data,r=((pe.event.special[o.origType]||{}).handle||o.handler).apply(i.elem,s),void 0!==r&&(e.result=r)===!1&&(e.preventDefault(),e.stopPropagation()));return l.postDispatch&&l.postDispatch.call(this,e),e.result}},handlers:function(e,t){var n,r,i,o,a=[],s=t.delegateCount,u=e.target;if(s&&u.nodeType&&("click"!==e.type||isNaN(e.button)||e.button<1))for(;u!=this;u=u.parentNode||this)if(1===u.nodeType&&(u.disabled!==!0||"click"!==e.type)){for(r=[],n=0;n-1:pe.find(i,this,null,[u]).length),r[i]&&r.push(o);r.length&&a.push({elem:u,handlers:r})}return s\s*$/g,at=p(re),st=at.appendChild(re.createElement("div"));pe.extend({htmlPrefilter:function(e){return e.replace(tt,"<$ueditor>")},clone:function(e,t,n){var r,i,o,a,s,u=pe.contains(e.ownerDocument,e);if(fe.html5Clone||pe.isXMLDoc(e)||!et.test("<"+e.nodeName+">")?o=e.cloneNode(!0):(st.innerHTML=e.outerHTML,st.removeChild(o=st.firstChild)),!(fe.noCloneEvent&&fe.noCloneChecked||1!==e.nodeType&&11!==e.nodeType||pe.isXMLDoc(e)))for(r=h(o),s=h(e),a=0;null!=(i=s[a]);++a)r[a]&&k(i,r[a]);if(t)if(n)for(s=s||h(e),r=r||h(o),a=0;null!=(i=s[a]);a++)N(i,r[a]);else N(e,o);return r=h(o,"script"),r.length>0&&g(r,!u&&h(e,"script")),r=s=i=null,o},cleanData:function(e,t){for(var n,r,i,o,a=0,s=pe.expando,u=pe.cache,l=fe.attributes,c=pe.event.special;null!=(n=e[a]);a++)if((t||He(n))&&(i=n[s],o=i&&u[i])){if(o.events)for(r in o.events)c[r]?pe.event.remove(n,r):pe.removeEvent(n,r,o.handle);u[i]&&(delete u[i],l||"undefined"==typeof n.removeAttribute?n[s]=void 0:n.removeAttribute(s),ne.push(i))}}}),pe.fn.extend({domManip:S,detach:function(e){return A(this,e,!0)},remove:function(e){return A(this,e)},text:function(e){return Pe(this,function(e){return void 0===e?pe.text(this):this.empty().append((this[0]&&this[0].ownerDocument||re).createTextNode(e))},null,e,arguments.length)},append:function(){return S(this,arguments,function(e){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var t=T(this,e);t.appendChild(e)}})},prepend:function(){return S(this,arguments,function(e){if(1===this.nodeType||11===this.nodeType||9===this.nodeType){var t=T(this,e);t.insertBefore(e,t.firstChild)}})},before:function(){return S(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this)})},after:function(){return S(this,arguments,function(e){this.parentNode&&this.parentNode.insertBefore(e,this.nextSibling)})},empty:function(){for(var e,t=0;null!=(e=this[t]);t++){for(1===e.nodeType&&pe.cleanData(h(e,!1));e.firstChild;)e.removeChild(e.firstChild);e.options&&pe.nodeName(e,"select")&&(e.options.length=0)}return this},clone:function(e,t){return e=null!=e&&e,t=null==t?e:t,this.map(function(){return pe.clone(this,e,t)})},html:function(e){return Pe(this,function(e){var t=this[0]||{},n=0,r=this.length;if(void 0===e)return 1===t.nodeType?t.innerHTML.replace(Ze,""):void 0;if("string"==typeof e&&!nt.test(e)&&(fe.htmlSerialize||!et.test(e))&&(fe.leadingWhitespace||!$e.test(e))&&!Xe[(We.exec(e)||["",""])[1].toLowerCase()]){e=pe.htmlPrefilter(e);try{for(;nt 1)},show:function(){return q(this,!0)},hide:function(){return q(this)},toggle:function(e){return"boolean"==typeof e?e?this.show():this.hide():this.each(function(){Re(this)?pe(this).show():pe(this).hide()})}}),pe.Tween=O,O.prototype={constructor:O,init:function(e,t,n,r,i,o){this.elem=e,this.prop=n,this.easing=i||pe.easing._default,this.options=t,this.start=this.now=this.cur(),this.end=r,this.unit=o||(pe.cssNumber[n]?"":"px")},cur:function(){var e=O.propHooks[this.prop];return e&&e.get?e.get(this):O.propHooks._default.get(this)},run:function(e){var t,n=O.propHooks[this.prop];return this.options.duration?this.pos=t=pe.easing[this.easing](e,this.options.duration*e,0,1,this.options.duration):this.pos=t=e,this.now=(this.end-this.start)*t+this.start,this.options.step&&this.options.step.call(this.elem,this.now,this),n&&n.set?n.set(this):O.propHooks._default.set(this),this}},O.prototype.init.prototype=O.prototype,O.propHooks={_default:{get:function(e){var t;return 1!==e.elem.nodeType||null!=e.elem[e.prop]&&null==e.elem.style[e.prop]?e.elem[e.prop]:(t=pe.css(e.elem,e.prop,""),t&&"auto"!==t?t:0)},set:function(e){pe.fx.step[e.prop]?pe.fx.step[e.prop](e):1!==e.elem.nodeType||null==e.elem.style[pe.cssProps[e.prop]]&&!pe.cssHooks[e.prop]?e.elem[e.prop]=e.now:pe.style(e.elem,e.prop,e.now+e.unit)}}},O.propHooks.scrollTop=O.propHooks.scrollLeft={set:function(e){e.elem.nodeType&&e.elem.parentNode&&(e.elem[e.prop]=e.now)}},pe.easing={linear:function(e){return e},swing:function(e){return.5-Math.cos(e*Math.PI)/2},_default:"swing"},pe.fx=O.prototype.init,pe.fx.step={};var Nt,kt,St=/^(?:toggle|show|hide)$/,At=/queueHooks$/;pe.Animation=pe.extend($,{tweeners:{"*":[function(e,t){var n=this.createTween(e,t);return d(n.elem,e,Me.exec(t),n),n}]},tweener:function(e,t){pe.isFunction(e)?(t=e,e=["*"]):e=e.match(De);for(var n,r=0,i=e.length;ra -1)try{r.selected=n=!0}catch(s){r.scrollHeight}else r.selected=!1;return n||(e.selectedIndex=-1),i}}}}),pe.each(["radio","checkbox"],function(){pe.valHooks[this]={set:function(e,t){if(pe.isArray(t))return e.checked=pe.inArray(pe(e).val(),t)>-1}},fe.checkOn||(pe.valHooks[this].get=function(e){return null===e.getAttribute("value")?"on":e.value})});var Lt,Ht,qt=pe.expr.attrHandle,_t=/^(?:checked|selected)$/i,Ft=fe.getSetAttribute,Mt=fe.input;pe.fn.extend({attr:function(e,t){return Pe(this,pe.attr,e,t,arguments.length>1)},removeAttr:function(e){return this.each(function(){pe.removeAttr(this,e)})}}),pe.extend({attr:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return"undefined"==typeof e.getAttribute?pe.prop(e,t,n):(1===o&&pe.isXMLDoc(e)||(t=t.toLowerCase(),i=pe.attrHooks[t]||(pe.expr.match.bool.test(t)?Ht:Lt)),void 0!==n?null===n?void pe.removeAttr(e,t):i&&"set"in i&&void 0!==(r=i.set(e,n,t))?r:(e.setAttribute(t,n+""),n):i&&"get"in i&&null!==(r=i.get(e,t))?r:(r=pe.find.attr(e,t),null==r?void 0:r))},attrHooks:{type:{set:function(e,t){if(!fe.radioValue&&"radio"===t&&pe.nodeName(e,"input")){var n=e.value;return e.setAttribute("type",t),n&&(e.value=n),t}}}},removeAttr:function(e,t){var n,r,i=0,o=t&&t.match(De);if(o&&1===e.nodeType)for(;n=o[i++];)r=pe.propFix[n]||n,pe.expr.match.bool.test(n)?Mt&&Ft||!_t.test(n)?e[r]=!1:e[pe.camelCase("default-"+n)]=e[r]=!1:pe.attr(e,n,""),e.removeAttribute(Ft?n:r)}}),Ht={set:function(e,t,n){return t===!1?pe.removeAttr(e,n):Mt&&Ft||!_t.test(n)?e.setAttribute(!Ft&&pe.propFix[n]||n,n):e[pe.camelCase("default-"+n)]=e[n]=!0,n}},pe.each(pe.expr.match.bool.source.match(/\w+/g),function(e,t){var n=qt[t]||pe.find.attr;Mt&&Ft||!_t.test(t)?qt[t]=function(e,t,r){var i,o;return r||(o=qt[t],qt[t]=i,i=null!=n(e,t,r)?t.toLowerCase():null,qt[t]=o),i}:qt[t]=function(e,t,n){if(!n)return e[pe.camelCase("default-"+t)]?t.toLowerCase():null}}),Mt&&Ft||(pe.attrHooks.value={set:function(e,t,n){return pe.nodeName(e,"input")?void(e.defaultValue=t):Lt&&Lt.set(e,t,n)}}),Ft||(Lt={set:function(e,t,n){var r=e.getAttributeNode(n);if(r||e.setAttributeNode(r=e.ownerDocument.createAttribute(n)),r.value=t+="","value"===n||t===e.getAttribute(n))return t}},qt.id=qt.name=qt.coords=function(e,t,n){var r;if(!n)return(r=e.getAttributeNode(t))&&""!==r.value?r.value:null},pe.valHooks.button={get:function(e,t){var n=e.getAttributeNode(t);if(n&&n.specified)return n.value},set:Lt.set},pe.attrHooks.contenteditable={set:function(e,t,n){Lt.set(e,""!==t&&t,n)}},pe.each(["width","height"],function(e,t){pe.attrHooks[t]={set:function(e,n){if(""===n)return e.setAttribute(t,"auto"),n}}})),fe.style||(pe.attrHooks.style={get:function(e){return e.style.cssText||void 0},set:function(e,t){return e.style.cssText=t+""}});var Ot=/^(?:input|select|textarea|button|object)$/i,Rt=/^(?:a|area)$/i;pe.fn.extend({prop:function(e,t){return Pe(this,pe.prop,e,t,arguments.length>1)},removeProp:function(e){return e=pe.propFix[e]||e,this.each(function(){try{this[e]=void 0,delete this[e]}catch(t){}})}}),pe.extend({prop:function(e,t,n){var r,i,o=e.nodeType;if(3!==o&&8!==o&&2!==o)return 1===o&&pe.isXMLDoc(e)||(t=pe.propFix[t]||t,i=pe.propHooks[t]),void 0!==n?i&&"set"in i&&void 0!==(r=i.set(e,n,t))?r:e[t]=n:i&&"get"in i&&null!==(r=i.get(e,t))?r:e[t]},propHooks:{tabIndex:{get:function(e){var t=pe.find.attr(e,"tabindex");return t?parseInt(t,10):Ot.test(e.nodeName)||Rt.test(e.nodeName)&&e.href?0:-1}}},propFix:{"for":"htmlFor","class":"className"}}),fe.hrefNormalized||pe.each(["href","src"],function(e,t){pe.propHooks[t]={get:function(e){return e.getAttribute(t,4)}}}),fe.optSelected||(pe.propHooks.selected={get:function(e){var t=e.parentNode;return t&&(t.selectedIndex,t.parentNode&&t.parentNode.selectedIndex),null},set:function(e){var t=e.parentNode;t&&(t.selectedIndex,t.parentNode&&t.parentNode.selectedIndex)}}),pe.each(["tabIndex","readOnly","maxLength","cellSpacing","cellPadding","rowSpan","colSpan","useMap","frameBorder","contentEditable"],function(){pe.propFix[this.toLowerCase()]=this}),fe.enctype||(pe.propFix.enctype="encoding");var Pt=/[\t\r\n\f]/g;pe.fn.extend({addClass:function(e){var t,n,r,i,o,a,s,u=0;if(pe.isFunction(e))return this.each(function(t){pe(this).addClass(e.call(this,t,z(this)))});if("string"==typeof e&&e)for(t=e.match(De)||[];n=this[u++];)if(i=z(n),r=1===n.nodeType&&(" "+i+" ").replace(Pt," ")){for(a=0;o=t[a++];)r.indexOf(" "+o+" ")<0&&(r+=o+" ");s=pe.trim(r),i!==s&&pe.attr(n,"class",s)}return this},removeClass:function(e){var t,n,r,i,o,a,s,u=0;if(pe.isFunction(e))return this.each(function(t){pe(this).removeClass(e.call(this,t,z(this)))});if(!arguments.length)return this.attr("class","");if("string"==typeof e&&e)for(t=e.match(De)||[];n=this[u++];)if(i=z(n),r=1===n.nodeType&&(" "+i+" ").replace(Pt," ")){for(a=0;o=t[a++];)for(;r.indexOf(" "+o+" ")>-1;)r=r.replace(" "+o+" "," ");s=pe.trim(r),i!==s&&pe.attr(n,"class",s)}return this},toggleClass:function(e,t){var n=typeof e;return"boolean"==typeof t&&"string"===n?t?this.addClass(e):this.removeClass(e):pe.isFunction(e)?this.each(function(n){pe(this).toggleClass(e.call(this,n,z(this),t),t)}):this.each(function(){var t,r,i,o;if("string"===n)for(r=0,i=pe(this),o=e.match(De)||[];t=o[r++];)i.hasClass(t)?i.removeClass(t):i.addClass(t);else void 0!==e&&"boolean"!==n||(t=z(this),t&&pe._data(this,"__className__",t),pe.attr(this,"class",t||e===!1?"":pe._data(this,"__className__")||""))})},hasClass:function(e){var t,n,r=0;for(t=" "+e+" ";n=this[r++];)if(1===n.nodeType&&(" "+z(n)+" ").replace(Pt," ").indexOf(t)>-1)return!0;return!1}}),pe.each("blur focus focusin focusout load resize scroll unload click dblclick mousedown mouseup mousemove mouseover mouseout mouseenter mouseleave change select submit keydown keypress keyup error contextmenu".split(" "),function(e,t){pe.fn[t]=function(e,n){return arguments.length>0?this.on(t,null,e,n):this.trigger(t)}}),pe.fn.extend({hover:function(e,t){return this.mouseenter(e).mouseleave(t||e)}});var Bt=e.location,Wt=pe.now(),It=/\?/,$t=/(,)|(\[|{)|(}|])|"(?:[^"\\\r\n]|\\["\\\/bfnrt]|\\u[\da-fA-F]{4})*"\s*:?|true|false|null|-?(?!0\d)\d+(?:\.\d+|)(?:[eE][+-]?\d+|)/g;pe.parseJSON=function(t){if(e.JSON&&e.JSON.parse)return e.JSON.parse(t+"");var n,r=null,i=pe.trim(t+"");return i&&!pe.trim(i.replace($t,function(e,t,i,o){return n&&t&&(r=0),0===r?e:(n=i||t,r+=!o-!i,"")}))?Function("return "+i)():pe.error("Invalid JSON: "+t)},pe.parseXML=function(t){var n,r;if(!t||"string"!=typeof t)return null;try{e.DOMParser?(r=new e.DOMParser,n=r.parseFromString(t,"text/xml")):(n=new e.ActiveXObject("Microsoft.XMLDOM"),n.async="false",n.loadXML(t))}catch(i){n=void 0}return n&&n.documentElement&&!n.getElementsByTagName("parsererror").length||pe.error("Invalid XML: "+t),n};var zt=/#.*$/,Xt=/([?&])_=[^&]*/,Ut=/^(.*?):[ \t]*([^\r\n]*)\r?$/gm,Vt=/^(?:about|app|app-storage|.+-extension|file|res|widget):$/,Yt=/^(?:GET|HEAD)$/,Jt=/^\/\//,Gt=/^([\w.+-]+:)(?:\/\/(?:[^\/?#]*@|)([^\/?#:]*)(?::(\d+)|)|)/,Kt={},Qt={},Zt="*/".concat("*"),en=Bt.href,tn=Gt.exec(en.toLowerCase())||[];pe.extend({active:0,lastModified:{},etag:{},ajaxSettings:{url:en,type:"GET",isLocal:Vt.test(tn[1]),global:!0,processData:!0,async:!0,contentType:"application/x-www-form-urlencoded; charset=UTF-8",accepts:{"*":Zt,text:"text/plain",html:"text/html",xml:"application/xml, text/xml",json:"application/json, text/javascript"},contents:{xml:/\bxml\b/,html:/\bhtml/,json:/\bjson\b/},responseFields:{xml:"responseXML",text:"responseText",json:"responseJSON"},converters:{"* text":String,"text html":!0,"text json":pe.parseJSON,"text xml":pe.parseXML},flatOptions:{url:!0,context:!0}},ajaxSetup:function(e,t){return t?V(V(e,pe.ajaxSettings),t):V(pe.ajaxSettings,e)},ajaxPrefilter:X(Kt),ajaxTransport:X(Qt),ajax:function(t,n){function r(t,n,r,i){var o,f,v,x,w,C=n;2!==b&&(b=2,u&&e.clearTimeout(u),c=void 0,s=i||"",T.readyState=t>0?4:0,o=t>=200&&t<300||304===t,r&&(x=Y(d,T,r)),x=J(d,x,T,o),o?(d.ifModified&&(w=T.getResponseHeader("Last-Modified"),w&&(pe.lastModified[a]=w),w=T.getResponseHeader("etag"),w&&(pe.etag[a]=w)),204===t||"HEAD"===d.type?C="nocontent":304===t?C="notmodified":(C=x.state,f=x.data,v=x.error,o=!v)):(v=C,!t&&C||(C="error",t<0&&(t=0))),T.status=t,T.statusText=(n||C)+"",o?g.resolveWith(p,[f,C,T]):g.rejectWith(p,[T,C,v]),T.statusCode(y),y=void 0,l&&h.trigger(o?"ajaxSuccess":"ajaxError",[T,d,o?f:v]),m.fireWith(p,[T,C]),l&&(h.trigger("ajaxComplete",[T,d]),--pe.active||pe.event.trigger("ajaxStop")))}"object"==typeof t&&(n=t,t=void 0),n=n||{};var i,o,a,s,u,l,c,f,d=pe.ajaxSetup({},n),p=d.context||d,h=d.context&&(p.nodeType||p.jquery)?pe(p):pe.event,g=pe.Deferred(),m=pe.Callbacks("once memory"),y=d.statusCode||{},v={},x={},b=0,w="canceled",T={readyState:0,getResponseHeader:function(e){var t;if(2===b){if(!f)for(f={};t=Ut.exec(s);)f[t[1].toLowerCase()]=t[2];t=f[e.toLowerCase()]}return null==t?null:t},getAllResponseHeaders:function(){return 2===b?s:null},setRequestHeader:function(e,t){var n=e.toLowerCase();return b||(e=x[n]=x[n]||e,v[e]=t),this},overrideMimeType:function(e){return b||(d.mimeType=e),this},statusCode:function(e){var t;if(e)if(b<2)for(t in e)y[t]=[y[t],e[t]];else T.always(e[T.status]);return this},abort:function(e){var t=e||w;return c&&c.abort(t),r(0,t),this}};if(g.promise(T).complete=m.add,T.success=T.done,T.error=T.fail,d.url=((t||d.url||en)+"").replace(zt,"").replace(Jt,tn[1]+"//"),d.type=n.method||n.type||d.method||d.type,d.dataTypes=pe.trim(d.dataType||"*").toLowerCase().match(De)||[""],null==d.crossDomain&&(i=Gt.exec(d.url.toLowerCase()),d.crossDomain=!(!i||i[1]===tn[1]&&i[2]===tn[2]&&(i[3]||("http:"===i[1]?"80":"443"))===(tn[3]||("http:"===tn[1]?"80":"443")))),d.data&&d.processData&&"string"!=typeof d.data&&(d.data=pe.param(d.data,d.traditional)),U(Kt,d,n,T),2===b)return T;l=pe.event&&d.global,l&&0===pe.active++&&pe.event.trigger("ajaxStart"),d.type=d.type.toUpperCase(),d.hasContent=!Yt.test(d.type),a=d.url,d.hasContent||(d.data&&(a=d.url+=(It.test(a)?"&":"?")+d.data,delete d.data),d.cache===!1&&(d.url=Xt.test(a)?a.replace(Xt,"$1_="+Wt++):a+(It.test(a)?"&":"?")+"_="+Wt++)),d.ifModified&&(pe.lastModified[a]&&T.setRequestHeader("If-Modified-Since",pe.lastModified[a]),pe.etag[a]&&T.setRequestHeader("If-None-Match",pe.etag[a])),(d.data&&d.hasContent&&d.contentType!==!1||n.contentType)&&T.setRequestHeader("Content-Type",d.contentType),T.setRequestHeader("Accept",d.dataTypes[0]&&d.accepts[d.dataTypes[0]]?d.accepts[d.dataTypes[0]]+("*"!==d.dataTypes[0]?", "+Zt+"; q=0.01":""):d.accepts["*"]);for(o in d.headers)T.setRequestHeader(o,d.headers[o]);if(d.beforeSend&&(d.beforeSend.call(p,T,d)===!1||2===b))return T.abort();w="abort";for(o in{success:1,error:1,complete:1})T[o](d[o]);if(c=U(Qt,d,n,T)){if(T.readyState=1,l&&h.trigger("ajaxSend",[T,d]),2===b)return T;d.async&&d.timeout>0&&(u=e.setTimeout(function(){T.abort("timeout")},d.timeout));try{b=1,c.send(v,r)}catch(C){if(!(b<2))throw C;r(-1,C)}}else r(-1,"No Transport");return T},getJSON:function(e,t,n){return pe.get(e,t,n,"json")},getScript:function(e,t){return pe.get(e,void 0,t,"script")}}),pe.each(["get","post"],function(e,t){pe[t]=function(e,n,r,i){return pe.isFunction(n)&&(i=i||r,r=n,n=void 0),pe.ajax(pe.extend({url:e,type:t,dataType:i,data:n,success:r},pe.isPlainObject(e)&&e))}}),pe._evalUrl=function(e){return pe.ajax({url:e,type:"GET",dataType:"script",cache:!0,async:!1,global:!1,"throws":!0})},pe.fn.extend({wrapAll:function(e){if(pe.isFunction(e))return this.each(function(t){pe(this).wrapAll(e.call(this,t))});if(this[0]){var t=pe(e,this[0].ownerDocument).eq(0).clone(!0);this[0].parentNode&&t.insertBefore(this[0]),t.map(function(){for(var e=this;e.firstChild&&1===e.firstChild.nodeType;)e=e.firstChild;return e}).append(this)}return this},wrapInner:function(e){return pe.isFunction(e)?this.each(function(t){pe(this).wrapInner(e.call(this,t))}):this.each(function(){var t=pe(this),n=t.contents();n.length?n.wrapAll(e):t.append(e)})},wrap:function(e){var t=pe.isFunction(e);return this.each(function(n){pe(this).wrapAll(t?e.call(this,n):e)})},unwrap:function(){return this.parent().each(function(){pe.nodeName(this,"body")||pe(this).replaceWith(this.childNodes)}).end()}}),pe.expr.filters.hidden=function(e){return fe.reliableHiddenOffsets()?e.offsetWidth<=0&&e.offsetHeight<=0&&!e.getClientRects().length:K(e)},pe.expr.filters.visible=function(e){return!pe.expr.filters.hidden(e)};var nn=/%20/g,rn=/\[\]$/,on=/\r?\n/g,an=/^(?:submit|button|image|reset|file)$/i,sn=/^(?:input|select|textarea|keygen)/i;pe.param=function(e,t){var n,r=[],i=function(e,t){t=pe.isFunction(t)?t():null==t?"":t,r[r.length]=encodeURIComponent(e)+"="+encodeURIComponent(t)};if(void 0===t&&(t=pe.ajaxSettings&&pe.ajaxSettings.traditional),pe.isArray(e)||e.jquery&&!pe.isPlainObject(e))pe.each(e,function(){i(this.name,this.value)});else for(n in e)Q(n,e[n],t,i);return r.join("&").replace(nn,"+")},pe.fn.extend({serialize:function(){return pe.param(this.serializeArray())},serializeArray:function(){return this.map(function(){var e=pe.prop(this,"elements");return e?pe.makeArray(e):this}).filter(function(){var e=this.type;return this.name&&!pe(this).is(":disabled")&&sn.test(this.nodeName)&&!an.test(e)&&(this.checked||!Be.test(e))}).map(function(e,t){var n=pe(this).val();return null==n?null:pe.isArray(n)?pe.map(n,function(e){return{name:t.name,value:e.replace(on,"\r\n")}}):{name:t.name,value:n.replace(on,"\r\n")}}).get()}}),pe.ajaxSettings.xhr=void 0!==e.ActiveXObject?function(){return this.isLocal?ee():re.documentMode>8?Z():/^(get|post|head|put|delete|options)$/i.test(this.type)&&Z()||ee()}:Z;var un=0,ln={},cn=pe.ajaxSettings.xhr();e.attachEvent&&e.attachEvent("onunload",function(){for(var e in ln)ln[e](void 0,!0)}),fe.cors=!!cn&&"withCredentials"in cn,cn=fe.ajax=!!cn,cn&&pe.ajaxTransport(function(t){if(!t.crossDomain||fe.cors){var n;return{send:function(r,i){var o,a=t.xhr(),s=++un;if(a.open(t.type,t.url,t.async,t.username,t.password),t.xhrFields)for(o in t.xhrFields)a[o]=t.xhrFields[o];t.mimeType&&a.overrideMimeType&&a.overrideMimeType(t.mimeType),t.crossDomain||r["X-Requested-With"]||(r["X-Requested-With"]="XMLHttpRequest");for(o in r)void 0!==r[o]&&a.setRequestHeader(o,r[o]+"");a.send(t.hasContent&&t.data||null),n=function(e,r){var o,u,l;if(n&&(r||4===a.readyState))if(delete ln[s],n=void 0,a.onreadystatechange=pe.noop,r)4!==a.readyState&&a.abort();else{l={},o=a.status,"string"==typeof a.responseText&&(l.text=a.responseText);try{u=a.statusText}catch(c){u=""}o||!t.isLocal||t.crossDomain?1223===o&&(o=204):o=l.text?200:404}l&&i(o,u,l,a.getAllResponseHeaders())},t.async?4===a.readyState?e.setTimeout(n):a.onreadystatechange=ln[s]=n:n()},abort:function(){n&&n(void 0,!0)}}}}),pe.ajaxSetup({accepts:{script:"text/javascript, application/javascript, application/ecmascript, application/x-ecmascript"},contents:{script:/\b(?:java|ecma)script\b/},converters:{"text script":function(e){return pe.globalEval(e),e}}}),pe.ajaxPrefilter("script",function(e){void 0===e.cache&&(e.cache=!1),e.crossDomain&&(e.type="GET",e.global=!1)}),pe.ajaxTransport("script",function(e){if(e.crossDomain){var t,n=re.head||pe("head")[0]||re.documentElement;return{send:function(r,i){t=re.createElement("script"),t.async=!0,e.scriptCharset&&(t.charset=e.scriptCharset),t.src=e.url,t.onload=t.onreadystatechange=function(e,n){(n||!t.readyState||/loaded|complete/.test(t.readyState))&&(t.onload=t.onreadystatechange=null,t.parentNode&&t.parentNode.removeChild(t),t=null,n||i(200,"success"))},n.insertBefore(t,n.firstChild)},abort:function(){t&&t.onload(void 0,!0)}}}});var fn=[],dn=/(=)\?(?=&|$)|\?\?/;pe.ajaxSetup({jsonp:"callback",jsonpCallback:function(){var e=fn.pop()||pe.expando+"_"+Wt++;return this[e]=!0,e}}),pe.ajaxPrefilter("json jsonp",function(t,n,r){var i,o,a,s=t.jsonp!==!1&&(dn.test(t.url)?"url":"string"==typeof t.data&&0===(t.contentType||"").indexOf("application/x-www-form-urlencoded")&&dn.test(t.data)&&"data");if(s||"jsonp"===t.dataTypes[0])return i=t.jsonpCallback=pe.isFunction(t.jsonpCallback)?t.jsonpCallback():t.jsonpCallback,s?t[s]=t[s].replace(dn,"$1"+i):t.jsonp!==!1&&(t.url+=(It.test(t.url)?"&":"?")+t.jsonp+"="+i),t.converters["script json"]=function(){return a||pe.error(i+" was not called"),a[0]},t.dataTypes[0]="json",o=e[i],e[i]=function(){a=arguments},r.always(function(){void 0===o?pe(e).removeProp(i):e[i]=o,t[i]&&(t.jsonpCallback=n.jsonpCallback,fn.push(i)),a&&pe.isFunction(o)&&o(a[0]),a=o=void 0}),"script"}),pe.parseHTML=function(e,t,n){if(!e||"string"!=typeof e)return null;"boolean"==typeof t&&(n=t,t=!1),t=t||re;var r=Te.exec(e),i=!n&&[];return r?[t.createElement(r[1])]:(r=y([e],t,i),i&&i.length&&pe(i).remove(),pe.merge([],r.childNodes))};var pn=pe.fn.load;return pe.fn.load=function(e,t,n){if("string"!=typeof e&&pn)return pn.apply(this,arguments);var r,i,o,a=this,s=e.indexOf(" ");return s>-1&&(r=pe.trim(e.slice(s,e.length)),e=e.slice(0,s)),pe.isFunction(t)?(n=t,t=void 0):t&&"object"==typeof t&&(i="POST"),a.length>0&&pe.ajax({url:e,type:i||"GET",dataType:"html",data:t}).done(function(e){o=arguments,a.html(r?pe("").append(pe.parseHTML(e)).find(r):e)}).always(n&&function(e,t){a.each(function(){n.apply(this,o||[e.responseText,t,e])})}),this},pe.each(["ajaxStart","ajaxStop","ajaxComplete","ajaxError","ajaxSuccess","ajaxSend"],function(e,t){pe.fn[t]=function(e){return this.on(t,e)}}),pe.expr.filters.animated=function(e){return pe.grep(pe.timers,function(t){return e===t.elem}).length},pe.offset={setOffset:function(e,t,n){var r,i,o,a,s,u,l,c=pe.css(e,"position"),f=pe(e),d={};"static"===c&&(e.style.position="relative"),s=f.offset(),o=pe.css(e,"top"),u=pe.css(e,"left"),l=("absolute"===c||"fixed"===c)&&pe.inArray("auto",[o,u])>-1,l?(r=f.position(),a=r.top,i=r.left):(a=parseFloat(o)||0,i=parseFloat(u)||0),pe.isFunction(t)&&(t=t.call(e,n,pe.extend({},s))),null!=t.top&&(d.top=t.top-s.top+a),null!=t.left&&(d.left=t.left-s.left+i),"using"in t?t.using.call(e,d):f.css(d)}},pe.fn.extend({offset:function(e){if(arguments.length)return void 0===e?this:this.each(function(t){pe.offset.setOffset(this,e,t)});var t,n,r={top:0,left:0},i=this[0],o=i&&i.ownerDocument;if(o)return t=o.documentElement,pe.contains(t,i)?("undefined"!=typeof i.getBoundingClientRect&&(r=i.getBoundingClientRect()),n=te(o),{top:r.top+(n.pageYOffset||t.scrollTop)-(t.clientTop||0),left:r.left+(n.pageXOffset||t.scrollLeft)-(t.clientLeft||0)}):r},position:function(){if(this[0]){var e,t,n={top:0,left:0},r=this[0];return"fixed"===pe.css(r,"position")?t=r.getBoundingClientRect():(e=this.offsetParent(),t=this.offset(),pe.nodeName(e[0],"html")||(n=e.offset()),n.top+=pe.css(e[0],"borderTopWidth",!0),n.left+=pe.css(e[0],"borderLeftWidth",!0)),{top:t.top-n.top-pe.css(r,"marginTop",!0),left:t.left-n.left-pe.css(r,"marginLeft",!0)}}},offsetParent:function(){
+return this.map(function(){for(var e=this.offsetParent;e&&!pe.nodeName(e,"html")&&"static"===pe.css(e,"position");)e=e.offsetParent;return e||pt})}}),pe.each({scrollLeft:"pageXOffset",scrollTop:"pageYOffset"},function(e,t){var n=/Y/.test(t);pe.fn[e]=function(r){return Pe(this,function(e,r,i){var o=te(e);return void 0===i?o?t in o?o[t]:o.document.documentElement[r]:e[r]:void(o?o.scrollTo(n?pe(o).scrollLeft():i,n?i:pe(o).scrollTop()):e[r]=i)},e,r,arguments.length,null)}}),pe.each(["top","left"],function(e,t){pe.cssHooks[t]=L(fe.pixelPosition,function(e,n){if(n)return n=gt(e,t),ft.test(n)?pe(e).position()[t]+"px":n})}),pe.each({Height:"height",Width:"width"},function(e,t){pe.each({padding:"inner"+e,content:t,"":"outer"+e},function(n,r){pe.fn[r]=function(r,i){var o=arguments.length&&(n||"boolean"!=typeof r),a=n||(r===!0||i===!0?"margin":"border");return Pe(this,function(t,n,r){var i;return pe.isWindow(t)?t.document.documentElement["client"+e]:9===t.nodeType?(i=t.documentElement,Math.max(t.body["scroll"+e],i["scroll"+e],t.body["offset"+e],i["offset"+e],i["client"+e])):void 0===r?pe.css(t,n,a):pe.style(t,n,r,a)},t,o?r:void 0,o,null)}})}),pe.fn.extend({bind:function(e,t,n){return this.on(e,null,t,n)},unbind:function(e,t){return this.off(e,null,t)},delegate:function(e,t,n,r){return this.on(t,e,n,r)},undelegate:function(e,t,n){return 1===arguments.length?this.off(e,"**"):this.off(t,e||"**",n)}}),pe.fn.size=function(){return this.length},pe.fn.andSelf=pe.fn.addBack,layui.define(function(e){layui.$=pe,e("jquery",pe)}),pe});!function(e,t){"use strict";var i,n,a=e.layui&&layui.define,o={getPath:function(){var e=document.currentScript?document.currentScript.src:function(){for(var e,t=document.scripts,i=t.length-1,n=i;n>0;n--)if("interactive"===t[n].readyState){e=t[n].src;break}return e||t[i].src}();return e.substring(0,e.lastIndexOf("/")+1)}(),config:{},end:{},minIndex:0,minLeft:[],btn:["确定","取消"],type:["dialog","page","iframe","loading","tips"],getStyle:function(t,i){var n=t.currentStyle?t.currentStyle:e.getComputedStyle(t,null);return n[n.getPropertyValue?"getPropertyValue":"getAttribute"](i)},link:function(t,i,n){if(r.path){var a=document.getElementsByTagName("head")[0],s=document.createElement("link");"string"==typeof i&&(n=i);var l=(n||t).replace(/\.|\//g,""),f="layuicss-"+l,c=0;s.rel="stylesheet",s.href=r.path+t,s.id=f,document.getElementById(f)||a.appendChild(s),"function"==typeof i&&!function u(){return++c>80?e.console&&console.error("layer.css: Invalid"):void(1989===parseInt(o.getStyle(document.getElementById(f),"width"))?i():setTimeout(u,100))}()}}},r={v:"3.3.0",ie:function(){var t=navigator.userAgent.toLowerCase();return!!(e.ActiveXObject||"ActiveXObject"in e)&&((t.match(/msie\s(\d+)/)||[])[1]||"11")}(),index:e.layer&&e.layer.v?1e5:0,path:o.getPath,config:function(e,t){return e=e||{},r.cache=o.config=i.extend({},o.config,e),r.path=o.config.path||r.path,"string"==typeof e.extend&&(e.extend=[e.extend]),o.config.path&&r.ready(),e.extend?(a?layui.addcss("modules/layer/"+e.extend):o.link("theme/"+e.extend),this):this},ready:function(e){var t="layer",i="",n=(a?"modules/layer/":"theme/")+"default/layer.css?v="+r.v+i;return a?layui.addcss(n,e,t):o.link(n,e,t),this},alert:function(e,t,n){var a="function"==typeof t;return a&&(n=t),r.open(i.extend({content:e,yes:n},a?{}:t))},confirm:function(e,t,n,a){var s="function"==typeof t;return s&&(a=n,n=t),r.open(i.extend({content:e,btn:o.btn,yes:n,btn2:a},s?{}:t))},msg:function(e,n,a){var s="function"==typeof n,f=o.config.skin,c=(f?f+" "+f+"-msg":"")||"layui-layer-msg",u=l.anim.length-1;return s&&(a=n),r.open(i.extend({content:e,time:3e3,shade:!1,skin:c,title:!1,closeBtn:!1,btn:!1,resize:!1,end:a},s&&!o.config.skin?{skin:c+" layui-layer-hui",anim:u}:function(){return n=n||{},(n.icon===-1||n.icon===t&&!o.config.skin)&&(n.skin=c+" "+(n.skin||"layui-layer-hui")),n}()))},load:function(e,t){return r.open(i.extend({type:3,icon:e||0,resize:!1,shade:.01},t))},tips:function(e,t,n){return r.open(i.extend({type:4,content:[e,t],closeBtn:!1,time:3e3,shade:!1,resize:!1,fixed:!1,maxWidth:260},n))}},s=function(e){var t=this,a=function(){r.ready(function(){t.creat()})};t.index=++r.index,t.config.maxWidth=i(n).width()-30,t.config=i.extend({},t.config,o.config,e),document.body?a():setTimeout(function(){a()},30)};s.pt=s.prototype;var l=["layui-layer",".layui-layer-title",".layui-layer-main",".layui-layer-dialog","layui-layer-iframe","layui-layer-content","layui-layer-btn","layui-layer-close"];l.anim=["layer-anim-00","layer-anim-01","layer-anim-02","layer-anim-03","layer-anim-04","layer-anim-05","layer-anim-06"],s.pt.config={type:0,shade:.3,fixed:!0,move:l[1],title:"信息",offset:"auto",area:"auto",closeBtn:1,time:0,zIndex:19891014,maxWidth:360,anim:0,isOutAnim:!0,icon:-1,moveType:1,resize:!0,scrollbar:!0,tips:2},s.pt.vessel=function(e,t){var n=this,a=n.index,r=n.config,s=r.zIndex+a,f="object"==typeof r.title,c=r.maxmin&&(1===r.type||2===r.type),u=r.title?'
'+(f?r.title[0]:r.title)+"
":"";return r.zIndex=s,t([r.shade?'
':"",'
'+(e&&2!=r.type?"":u)+'
'+(0==r.type&&r.icon!==-1?'
'+function(){var e=c?' "+(r.btn?function(){var e="";"string"==typeof r.btn&&(r.btn=[r.btn]);for(var t=0,i=r.btn.length;t
'+r.btn[t]+"";return''+e+"
"}():"")+(r.resize?' "],u,i('
')),n},s.pt.creat=function(){var e=this,t=e.config,a=e.index,s=t.content,f="object"==typeof s,c=i("body");if(!t.id||!i("#"+t.id)[0]){switch("string"==typeof t.area&&(t.area="auto"===t.area?["",""]:[t.area,""]),t.shift&&(t.anim=t.shift),6==r.ie&&(t.fixed=!1),t.type){case 0:t.btn="btn"in t?t.btn:o.btn[0],r.closeAll("dialog");break;case 2:var s=t.content=f?t.content:[t.content||"","auto"];t.content='
';break;case 3:delete t.title,delete t.closeBtn,t.icon===-1&&0===t.icon,r.closeAll("loading");break;case 4:f||(t.content=[t.content,"body"]),t.follow=t.content[1],t.content=t.content[0]+'
',delete t.title,t.tips="object"==typeof t.tips?t.tips:[t.tips,!0],t.tipsMore||r.closeAll("tips")}if(e.vessel(f,function(n,r,u){c.append(n[0]),f?function(){2==t.type||4==t.type?function(){i("body").append(n[1])}():function(){s.parents("."+l[0])[0]||(s.data("display",s.css("display")).show().addClass("layui-layer-wrap").wrap(n[1]),i("#"+l[0]+a).find("."+l[5]).before(r))}()}():c.append(n[1]),i(".layui-layer-move")[0]||c.append(o.moveElem=u),e.layero=i("#"+l[0]+a),t.scrollbar||l.html.css("overflow","hidden").attr("layer-full",a)}).auto(a),i("#layui-layer-shade"+e.index).css({"background-color":t.shade[1]||"#000",opacity:t.shade[0]||t.shade}),2==t.type&&6==r.ie&&e.layero.find("iframe").attr("src",s[0]),4==t.type?e.tips():e.offset(),t.fixed&&n.on("resize",function(){e.offset(),(/^\d+%$/.test(t.area[0])||/^\d+%$/.test(t.area[1]))&&e.auto(a),4==t.type&&e.tips()}),t.time<=0||setTimeout(function(){r.close(e.index)},t.time),e.move().callback(),l.anim[t.anim]){var u="layer-anim "+l.anim[t.anim];e.layero.addClass(u).one("webkitAnimationEnd mozAnimationEnd MSAnimationEnd oanimationend animationend",function(){i(this).removeClass(u)})}t.isOutAnim&&e.layero.data("isOutAnim",!0)}},s.pt.auto=function(e){var t=this,a=t.config,o=i("#"+l[0]+e);""===a.area[0]&&a.maxWidth>0&&(r.ie&&r.ie<8&&a.btn&&o.width(o.innerWidth()),o.outerWidth()>a.maxWidth&&o.width(a.maxWidth));var s=[o.innerWidth(),o.innerHeight()],f=o.find(l[1]).outerHeight()||0,c=o.find("."+l[6]).outerHeight()||0,u=function(e){e=o.find(e),e.height(s[1]-f-c-2*(0|parseFloat(e.css("padding-top"))))};switch(a.type){case 2:u("iframe");break;default:""===a.area[1]?a.maxHeight>0&&o.outerHeight()>a.maxHeight?(s[1]=a.maxHeight,u("."+l[5])):a.fixed&&s[1]>=n.height()&&(s[1]=n.height(),u("."+l[5])):u("."+l[5])}return t},s.pt.offset=function(){var e=this,t=e.config,i=e.layero,a=[i.outerWidth(),i.outerHeight()],o="object"==typeof t.offset;e.offsetTop=(n.height()-a[1])/2,e.offsetLeft=(n.width()-a[0])/2,o?(e.offsetTop=t.offset[0],e.offsetLeft=t.offset[1]||e.offsetLeft):"auto"!==t.offset&&("t"===t.offset?e.offsetTop=0:"r"===t.offset?e.offsetLeft=n.width()-a[0]:"b"===t.offset?e.offsetTop=n.height()-a[1]:"l"===t.offset?e.offsetLeft=0:"lt"===t.offset?(e.offsetTop=0,e.offsetLeft=0):"lb"===t.offset?(e.offsetTop=n.height()-a[1],e.offsetLeft=0):"rt"===t.offset?(e.offsetTop=0,e.offsetLeft=n.width()-a[0]):"rb"===t.offset?(e.offsetTop=n.height()-a[1],e.offsetLeft=n.width()-a[0]):e.offsetTop=t.offset),t.fixed||(e.offsetTop=/%$/.test(e.offsetTop)?n.height()*parseFloat(e.offsetTop)/100:parseFloat(e.offsetTop),e.offsetLeft=/%$/.test(e.offsetLeft)?n.width()*parseFloat(e.offsetLeft)/100:parseFloat(e.offsetLeft),e.offsetTop+=n.scrollTop(),e.offsetLeft+=n.scrollLeft()),i.attr("minLeft")&&(e.offsetTop=n.height()-(i.find(l[1]).outerHeight()||0),e.offsetLeft=i.css("left")),i.css({top:e.offsetTop,left:e.offsetLeft})},s.pt.tips=function(){var e=this,t=e.config,a=e.layero,o=[a.outerWidth(),a.outerHeight()],r=i(t.follow);r[0]||(r=i("body"));var s={width:r.outerWidth(),height:r.outerHeight(),top:r.offset().top,left:r.offset().left},f=a.find(".layui-layer-TipsG"),c=t.tips[0];t.tips[1]||f.remove(),s.autoLeft=function(){s.left+o[0]-n.width()>0?(s.tipLeft=s.left+s.width-o[0],f.css({right:12,left:"auto"})):s.tipLeft=s.left},s.where=[function(){s.autoLeft(),s.tipTop=s.top-o[1]-10,f.removeClass("layui-layer-TipsB").addClass("layui-layer-TipsT").css("border-right-color",t.tips[1])},function(){s.tipLeft=s.left+s.width+10,s.tipTop=s.top,f.removeClass("layui-layer-TipsL").addClass("layui-layer-TipsR").css("border-bottom-color",t.tips[1])},function(){s.autoLeft(),s.tipTop=s.top+s.height+10,f.removeClass("layui-layer-TipsT").addClass("layui-layer-TipsB").css("border-right-color",t.tips[1])},function(){s.tipLeft=s.left-o[0]-10,s.tipTop=s.top,f.removeClass("layui-layer-TipsR").addClass("layui-layer-TipsL").css("border-bottom-color",t.tips[1])}],s.where[c-1](),1===c?s.top-(n.scrollTop()+o[1]+16)<0&&s.where[2]():2===c?n.width()-(s.left+s.width+o[0]+16)>0||s.where[3]():3===c?s.top-n.scrollTop()+s.height+o[1]+16-n.height()>0&&s.where[0]():4===c&&o[0]+16-s.left>0&&s.where[1](),a.find("."+l[5]).css({"background-color":t.tips[1],"padding-right":t.closeBtn?"30px":""}),a.css({left:s.tipLeft-(t.fixed?n.scrollLeft():0),top:s.tipTop-(t.fixed?n.scrollTop():0)})},s.pt.move=function(){var e=this,t=e.config,a=i(document),s=e.layero,l=s.find(t.move),f=s.find(".layui-layer-resize"),c={};return t.move&&l.css("cursor","move"),l.on("mousedown",function(e){e.preventDefault(),t.move&&(c.moveStart=!0,c.offset=[e.clientX-parseFloat(s.css("left")),e.clientY-parseFloat(s.css("top"))],o.moveElem.css("cursor","move").show())}),f.on("mousedown",function(e){e.preventDefault(),c.resizeStart=!0,c.offset=[e.clientX,e.clientY],c.area=[s.outerWidth(),s.outerHeight()],o.moveElem.css("cursor","se-resize").show()}),a.on("mousemove",function(i){if(c.moveStart){var a=i.clientX-c.offset[0],o=i.clientY-c.offset[1],l="fixed"===s.css("position");if(i.preventDefault(),c.stX=l?0:n.scrollLeft(),c.stY=l?0:n.scrollTop(),!t.moveOut){var f=n.width()-s.outerWidth()+c.stX,u=n.height()-s.outerHeight()+c.stY;a
f&&(a=f),ou&&(o=u)}s.css({left:a,top:o})}if(t.resize&&c.resizeStart){var a=i.clientX-c.offset[0],o=i.clientY-c.offset[1];i.preventDefault(),r.style(e.index,{width:c.area[0]+a,height:c.area[1]+o}),c.isResize=!0,t.resizing&&t.resizing(s)}}).on("mouseup",function(e){c.moveStart&&(delete c.moveStart,o.moveElem.hide(),t.moveEnd&&t.moveEnd(s)),c.resizeStart&&(delete c.resizeStart,o.moveElem.hide())}),e},s.pt.callback=function(){function e(){var e=a.cancel&&a.cancel(t.index,n);e===!1||r.close(t.index)}var t=this,n=t.layero,a=t.config;t.openLayer(),a.success&&(2==a.type?n.find("iframe").on("load",function(){a.success(n,t.index)}):a.success(n,t.index)),6==r.ie&&t.IE6(n),n.find("."+l[6]).children("a").on("click",function(){var e=i(this).index();if(0===e)a.yes?a.yes(t.index,n):a.btn1?a.btn1(t.index,n):r.close(t.index);else{var o=a["btn"+(e+1)]&&a["btn"+(e+1)](t.index,n);o===!1||r.close(t.index)}}),n.find("."+l[7]).on("click",e),a.shadeClose&&i("#layui-layer-shade"+t.index).on("click",function(){r.close(t.index)}),n.find(".layui-layer-min").on("click",function(){var e=a.min&&a.min(n);e===!1||r.min(t.index,a)}),n.find(".layui-layer-max").on("click",function(){i(this).hasClass("layui-layer-maxmin")?(r.restore(t.index),a.restore&&a.restore(n)):(r.full(t.index,a),setTimeout(function(){a.full&&a.full(n)},100))}),a.end&&(o.end[t.index]=a.end)},o.reselect=function(){i.each(i("select"),function(e,t){var n=i(this);n.parents("."+l[0])[0]||1==n.attr("layer")&&i("."+l[0]).length<1&&n.removeAttr("layer").show(),n=null})},s.pt.IE6=function(e){i("select").each(function(e,t){var n=i(this);n.parents("."+l[0])[0]||"none"===n.css("display")||n.attr({layer:"1"}).hide(),n=null})},s.pt.openLayer=function(){var e=this;r.zIndex=e.config.zIndex,r.setTop=function(e){var t=function(){r.zIndex++,e.css("z-index",r.zIndex+1)};return r.zIndex=parseInt(e[0].style.zIndex),e.on("mousedown",t),r.zIndex}},o.record=function(e){var t=[e.width(),e.height(),e.position().top,e.position().left+parseFloat(e.css("margin-left"))];e.find(".layui-layer-max").addClass("layui-layer-maxmin"),e.attr({area:t})},o.rescollbar=function(e){l.html.attr("layer-full")==e&&(l.html[0].style.removeProperty?l.html[0].style.removeProperty("overflow"):l.html[0].style.removeAttribute("overflow"),l.html.removeAttr("layer-full"))},e.layer=r,r.getChildFrame=function(e,t){return t=t||i("."+l[4]).attr("times"),i("#"+l[0]+t).find("iframe").contents().find(e)},r.getFrameIndex=function(e){return i("#"+e).parents("."+l[4]).attr("times")},r.iframeAuto=function(e){if(e){var t=r.getChildFrame("html",e).outerHeight(),n=i("#"+l[0]+e),a=n.find(l[1]).outerHeight()||0,o=n.find("."+l[6]).outerHeight()||0;n.css({height:t+a+o}),n.find("iframe").css({height:t})}},r.iframeSrc=function(e,t){i("#"+l[0]+e).find("iframe").attr("src",t)},r.style=function(e,t,n){var a=i("#"+l[0]+e),r=a.find(".layui-layer-content"),s=a.attr("type"),f=a.find(l[1]).outerHeight()||0,c=a.find("."+l[6]).outerHeight()||0;a.attr("minLeft");s!==o.type[3]&&s!==o.type[4]&&(n||(parseFloat(t.width)<=260&&(t.width=260),parseFloat(t.height)-f-c<=64&&(t.height=64+f+c)),a.css(t),c=a.find("."+l[6]).outerHeight(),s===o.type[2]?a.find("iframe").css({height:parseFloat(t.height)-f-c}):r.css({height:parseFloat(t.height)-f-c-parseFloat(r.css("padding-top"))-parseFloat(r.css("padding-bottom"))}))},r.min=function(e,t){var a=i("#"+l[0]+e),s=a.find(l[1]).outerHeight()||0,f=a.attr("minLeft")||181*o.minIndex+"px",c=a.css("position");o.record(a),o.minLeft[0]&&(f=o.minLeft[0],o.minLeft.shift()),a.attr("position",c),r.style(e,{width:180,height:s,left:f,top:n.height()-s,position:"fixed",overflow:"hidden"},!0),a.find(".layui-layer-min").hide(),"page"===a.attr("type")&&a.find(l[4]).hide(),o.rescollbar(e),a.attr("minLeft")||o.minIndex++,a.attr("minLeft",f)},r.restore=function(e){var t=i("#"+l[0]+e),n=t.attr("area").split(",");t.attr("type");r.style(e,{width:parseFloat(n[0]),height:parseFloat(n[1]),top:parseFloat(n[2]),left:parseFloat(n[3]),position:t.attr("position"),overflow:"visible"},!0),t.find(".layui-layer-max").removeClass("layui-layer-maxmin"),t.find(".layui-layer-min").show(),"page"===t.attr("type")&&t.find(l[4]).show(),o.rescollbar(e)},r.full=function(e){var t,a=i("#"+l[0]+e);o.record(a),l.html.attr("layer-full")||l.html.css("overflow","hidden").attr("layer-full",e),clearTimeout(t),t=setTimeout(function(){var t="fixed"===a.css("position");r.style(e,{top:t?0:n.scrollTop(),left:t?0:n.scrollLeft(),width:n.width(),height:n.height()},!0),a.find(".layui-layer-min").hide()},100)},r.title=function(e,t){var n=i("#"+l[0]+(t||r.index)).find(l[1]);n.html(e)},r.close=function(e){r.ready(function(){var t=i("#"+l[0]+e),n=t.attr("type"),a="layer-anim-close";if(t[0]){var s="layui-layer-wrap",f=function(){if(n===o.type[1]&&"object"===t.attr("conType")){t.children(":not(."+l[5]+")").remove();for(var a=t.find("."+s),r=0;r<2;r++)a.unwrap();a.css("display",a.data("display")).removeClass(s)}else{if(n===o.type[2])try{var f=i("#"+l[4]+e)[0];f.contentWindow.document.write(""),f.contentWindow.close(),t.find("."+l[5])[0].removeChild(f)}catch(c){}t[0].innerHTML="",t.remove()}"function"==typeof o.end[e]&&o.end[e](),delete o.end[e]};t.data("isOutAnim")&&t.addClass("layer-anim "+a),i("#layui-layer-moves, #layui-layer-shade"+e).remove(),6==r.ie&&o.reselect(),o.rescollbar(e),t.attr("minLeft")&&(o.minIndex--,o.minLeft.push(t.attr("minLeft"))),r.ie&&r.ie<10||!t.data("isOutAnim")?f():setTimeout(function(){f()},200)}})},r.closeAll=function(e){r.ready(function(){i.each(i("."+l[0]),function(){var t=i(this),n=e?t.attr("type")===e:1;n&&r.close(t.attr("times")),n=null})})};var f=r.cache||{},c=function(e){return f.skin?" "+f.skin+" "+f.skin+"-"+e:""};r.prompt=function(e,t){var a="";if(e=e||{},"function"==typeof e&&(t=e),e.area){var o=e.area;a='style="width: '+o[0]+"; height: "+o[1]+';"',delete e.area}var s,l=2==e.formType?'":function(){return''+t[0].title+" ";i"+t[i].title+"";return a}(),content:''+function(){var e=t.length,i=1,a="";if(e>0)for(a=''+(t[0].content||"no content")+" ";i'+(t[i].content||"no content")+"";return a}()+" ",success:function(t){var o=t.find(".layui-layer-title").children(),r=t.find(".layui-layer-tabmain").children();o.on("mousedown",function(t){t.stopPropagation?t.stopPropagation():t.cancelBubble=!0;var a=i(this),o=a.index();a.addClass(n).siblings().removeClass(n),r.eq(o).show().siblings().hide(),"function"==typeof e.change&&e.change(o)}),"function"==typeof a&&a(t)}},e))},r.photos=function(t,n,a){function o(e,t,i){var n=new Image;return n.src=e,n.complete?t(n):(n.onload=function(){n.onload=null,t(n)},void(n.onerror=function(e){n.onerror=null,i(e)}))}var s={};if(t=t||{},t.photos){var l=t.photos.constructor===Object,f=l?t.photos:{},u=f.data||[],d=f.start||0;s.imgIndex=(0|d)+1,t.img=t.img||"img";var y=t.success;if(delete t.success,l){if(0===u.length)return r.msg("没有图片")}else{var p=i(t.photos),h=function(){u=[],p.find(t.img).each(function(e){var t=i(this);t.attr("layer-index",e),u.push({alt:t.attr("alt"),pid:t.attr("layer-pid"),src:t.attr("layer-src")||t.attr("src"),thumb:t.attr("src")})})};if(h(),0===u.length)return;if(n||p.on("click",t.img,function(){var e=i(this),n=e.attr("layer-index");r.photos(i.extend(t,{photos:{start:n,data:u,tab:t.tab},full:t.full}),!0),h()}),!n)return}s.imgprev=function(e){s.imgIndex--,s.imgIndex<1&&(s.imgIndex=u.length),s.tabimg(e)},s.imgnext=function(e,t){s.imgIndex++,s.imgIndex>u.length&&(s.imgIndex=1,t)||s.tabimg(e)},s.keyup=function(e){if(!s.end){var t=e.keyCode;e.preventDefault(),37===t?s.imgprev(!0):39===t?s.imgnext(!0):27===t&&r.close(s.index)}},s.tabimg=function(e){if(!(u.length<=1))return f.start=s.imgIndex-1,r.close(s.index),r.photos(t,!0,e)},s.event=function(){s.bigimg.hover(function(){s.imgsee.show()},function(){s.imgsee.hide()}),s.bigimg.find(".layui-layer-imgprev").on("click",function(e){e.preventDefault(),s.imgprev()}),s.bigimg.find(".layui-layer-imgnext").on("click",function(e){e.preventDefault(),s.imgnext()}),i(document).on("keyup",s.keyup)},s.loadi=r.load(1,{shade:!("shade"in t)&&.9,scrollbar:!1}),o(u[d].src,function(n){r.close(s.loadi),s.index=r.open(i.extend({type:1,id:"layui-layer-photos",area:function(){var a=[n.width,n.height],o=[i(e).width()-100,i(e).height()-100];if(!t.full&&(a[0]>o[0]||a[1]>o[1])){var r=[a[0]/o[0],a[1]/o[1]];r[0]>r[1]?(a[0]=a[0]/r[0],a[1]=a[1]/r[0]):r[0] ',e.bar1?''+c[0]+" ":"",e.bar2?''+c[1]+" ":"",''+c[2]+" "," "].join("")),u=g.find("."+o),s=function(){var t=r.scrollTop();t>=e.showHeight?i||(u.show(),i=1):i&&(u.hide(),i=0)};t("."+n)[0]||("object"==typeof e.css&&g.css(e.css),l.append(g),s(),g.find("li").on("click",function(){var i=t(this),a=i.attr("lay-type");"top"===a&&t("html,body").animate({scrollTop:0},200),e.click&&e.click.call(this,a)}),r.on("scroll",function(){clearTimeout(a),a=setTimeout(function(){s()},100)}))},countdown:function(e,t,i){var a=this,n="function"==typeof t,o=new Date(e).getTime(),r=new Date(!t||n?(new Date).getTime():t).getTime(),l=o-r,c=[Math.floor(l/864e5),Math.floor(l/36e5)%24,Math.floor(l/6e4)%60,Math.floor(l/1e3)%60];n&&(i=t);var g=setTimeout(function(){a.countdown(e,r+1e3,i)},1e3);return i&&i(l>0?c:[0,0,0,0],t,g),l<=0&&clearTimeout(g),g},timeAgo:function(e,t){var i=this,a=[[],[]],n=(new Date).getTime()-new Date(e).getTime();return n>26784e5?(n=new Date(e),a[0][0]=i.digit(n.getFullYear(),4),a[0][1]=i.digit(n.getMonth()+1),a[0][2]=i.digit(n.getDate()),t||(a[1][0]=i.digit(n.getHours()),a[1][1]=i.digit(n.getMinutes()),a[1][2]=i.digit(n.getSeconds())),a[0].join("-")+" "+a[1].join(":")):n>=864e5?(n/1e3/60/60/24|0)+"天前":n>=36e5?(n/1e3/60/60|0)+"小时前":n>=18e4?(n/1e3/60|0)+"分钟前":n<0?"未来":"刚刚"},digit:function(e,t){var i="";e=String(e),t=t||2;for(var a=e.length;a"+(i.title||"unnaming")+" ";return s[0]?s.before(r):n.append(r),o.append(''+(i.content||"")+"
"),f.hideTabMore(!0),f.tabAuto(),this},s.prototype.tabDelete=function(t,i){var e=".layui-tab-title",l=a(".layui-tab[lay-filter="+t+"]"),n=l.children(e),s=n.find('>li[lay-id="'+i+'"]');return f.tabDelete(null,s),this},s.prototype.tabChange=function(t,i){var e=".layui-tab-title",l=a(".layui-tab[lay-filter="+t+"]"),n=l.children(e),s=n.find('>li[lay-id="'+i+'"]');return f.tabClick.call(s[0],null,null,s),this},s.prototype.tab=function(t){t=t||{},b.on("click",t.headerElem,function(i){var e=a(this).index();f.tabClick.call(this,i,e,null,t)})},s.prototype.progress=function(t,i){var e="layui-progress",l=a("."+e+"[lay-filter="+t+"]"),n=l.find("."+e+"-bar"),s=n.find("."+e+"-text");return n.css("width",i),s.text(i),this};var o=".layui-nav",r="layui-nav-item",c="layui-nav-bar",u="layui-nav-tree",d="layui-nav-child",y="layui-nav-more",h="layui-anim layui-anim-upbit",f={tabClick:function(t,i,s,o){o=o||{};var r=s||a(this),i=i||r.parent().children("li").index(r),c=o.headerElem?r.parent():r.parents(".layui-tab").eq(0),u=o.bodyElem?a(o.bodyElem):c.children(".layui-tab-content").children(".layui-tab-item"),d=r.find("a"),y=c.attr("lay-filter");"javascript:;"!==d.attr("href")&&"_blank"===d.attr("target")||(r.addClass(l).siblings().removeClass(l),u.eq(i).addClass(n).siblings().removeClass(n)),layui.event.call(this,e,"tab("+y+")",{elem:c,index:i})},tabDelete:function(t,i){var n=i||a(this).parent(),s=n.index(),o=n.parents(".layui-tab").eq(0),r=o.children(".layui-tab-content").children(".layui-tab-item"),c=o.attr("lay-filter");n.hasClass(l)&&(n.next()[0]?f.tabClick.call(n.next()[0],null,s+1):n.prev()[0]&&f.tabClick.call(n.prev()[0],null,s-1)),n.remove(),r.eq(s).remove(),setTimeout(function(){f.tabAuto()},50),layui.event.call(this,e,"tabDelete("+c+")",{elem:o,index:s})},tabAuto:function(){var t="layui-tab-more",e="layui-tab-bar",l="layui-tab-close",n=this;a(".layui-tab").each(function(){var s=a(this),o=s.children(".layui-tab-title"),r=(s.children(".layui-tab-content").children(".layui-tab-item"),'lay-stope="tabmore"'),c=a(' ဆ ');i.on("click",f.tabDelete),t.append(i)}}),"string"!=typeof s.attr("lay-unauto"))if(o.prop("scrollWidth")>o.outerWidth()+1){if(o.find("."+e)[0])return;o.append(c),s.attr("overflow",""),c.on("click",function(a){o[this.title?"removeClass":"addClass"](t),this.title=this.title?"":"收缩"})}else o.find("."+e).remove(),s.removeAttr("overflow")})},hideTabMore:function(t){var i=a(".layui-tab-title");t!==!0&&"tabmore"===a(t.target).attr("lay-stope")||(i.removeClass("layui-tab-more"),i.find(".layui-tab-bar").attr("title",""))},clickThis:function(){var t=a(this),i=t.parents(o),n=i.attr("lay-filter"),s=t.parent(),c=t.siblings("."+d),y="string"==typeof s.attr("lay-unselect");"javascript:;"!==t.attr("href")&&"_blank"===t.attr("target")||y||c[0]||(i.find("."+l).removeClass(l),s.addClass(l)),i.hasClass(u)&&(c.removeClass(h),c[0]&&(s["none"===c.css("display")?"addClass":"removeClass"](r+"ed"),"all"===i.attr("lay-shrink")&&s.siblings().removeClass(r+"ed"))),layui.event.call(this,e,"nav("+n+")",t)},collapse:function(){var t=a(this),i=t.find(".layui-colla-icon"),l=t.siblings(".layui-colla-content"),s=t.parents(".layui-collapse").eq(0),o=s.attr("lay-filter"),r="none"===l.css("display");if("string"==typeof s.attr("lay-accordion")){var c=s.children(".layui-colla-item").children("."+n);c.siblings(".layui-colla-title").children(".layui-colla-icon").html(""),c.removeClass(n)}l[r?"addClass":"removeClass"](n),i.html(r?"":""),layui.event.call(this,e,"collapse("+o+")",{title:t,content:l,show:r})}};s.prototype.init=function(t,e){var l=function(){return e?'[lay-filter="'+e+'"]':""}(),s={tab:function(){f.tabAuto.call({})},nav:function(){var t=200,e={},s={},p={},b=function(l,o,r){var c=a(this),f=c.find("."+d);o.hasClass(u)?l.css({top:c.position().top,height:c.children("a").outerHeight(),opacity:1}):(f.addClass(h),l.css({left:c.position().left+parseFloat(c.css("marginLeft")),top:c.position().top+c.height()-l.height()}),e[r]=setTimeout(function(){l.css({width:c.width(),opacity:1})},i.ie&&i.ie<10?0:t),clearTimeout(p[r]),"block"===f.css("display")&&clearTimeout(s[r]),s[r]=setTimeout(function(){f.addClass(n),c.find("."+y).addClass(y+"d")},300))};a(o+l).each(function(i){var l=a(this),o=a('"+e+" ")}),t.css("visibility","visible"))})},progress:function(){var t="layui-progress";a("."+t+l).each(function(){var i=a(this),e=i.find(".layui-progress-bar"),l=e.attr("lay-percent");e.css("width",function(){return/^.+\/.+$/.test(l)?100*new Function("return "+l)()+"%":l}()),i.attr("lay-showPercent")&&setTimeout(function(){e.html(''+l+" ")},350)})},collapse:function(){var t="layui-collapse";a("."+t+l).each(function(){var t=a(this).find(".layui-colla-item");t.each(function(){var t=a(this),i=t.find(".layui-colla-title"),e=t.find(".layui-colla-content"),l="none"===e.css("display");i.find(".layui-colla-icon").remove(),i.append(''+(l?"":"")+" "),i.off("click",f.collapse).on("click",f.collapse)})})}};return s[t]?s[t]():layui.each(s,function(t,a){a()})},s.prototype.render=s.prototype.init;var p=new s,b=a(document);p.render();var v=".layui-tab-title li";b.on("click",v,f.tabClick),b.on("click",f.hideTabMore),a(window).on("resize",f.tabAuto),t(e,p)});layui.define("layer",function(e){"use strict";var t=layui.$,i=layui.layer,n=layui.hint(),o=layui.device(),a={config:{},set:function(e){var i=this;return i.config=t.extend({},i.config,e),i},on:function(e,t){return layui.onevent.call(this,r,e,t)}},l=function(){var e=this;return{upload:function(t){e.upload.call(e,t)},reload:function(t){e.reload.call(e,t)},config:e.config}},r="upload",u="layui-upload-file",c="layui-upload-form",f="layui-upload-iframe",s="layui-upload-choose",p=function(e){var i=this;i.config=t.extend({},i.config,a.config,e),i.render()};p.prototype.config={accept:"images",exts:"",auto:!0,bindAction:"",url:"",field:"file",acceptMime:"",method:"post",data:{},drag:!0,size:0,number:0,multiple:!1},p.prototype.render=function(e){var i=this,e=i.config;e.elem=t(e.elem),e.bindAction=t(e.bindAction),i.file(),i.events()},p.prototype.file=function(){var e=this,i=e.config,n=e.elemFile=t(['
'),e.isFile()?(e.elemFile=i.elem,i.field=i.elem[0].name):i.elem.after(n),o.ie&&o.ie<10&&e.initIE()},p.prototype.initIE=function(){var e=this,i=e.config,n=t(''),o=t(['"].join(""));t("#"+f)[0]||t("body").append(n),i.elem.next().hasClass(c)||(e.elemFile.wrap(o),i.elem.next("."+c).append(function(){var e=[];return layui.each(i.data,function(t,i){i="function"==typeof i?i():i,e.push(''+a+" ")};i.elem.off("upload.start").on("upload.start",function(){var o=t(this),a=o.attr("lay-data");if(a)try{a=new Function("return "+a)(),e.config=t.extend({},i,a)}catch(l){n.error("Upload element property lay-data configuration item has a syntax error: "+a)}e.config.item=o,e.elemFile[0].click()}),o.ie&&o.ie<10||i.elem.off("upload.over").on("upload.over",function(){var e=t(this);e.attr("lay-over","")}).off("upload.leave").on("upload.leave",function(){var e=t(this);e.removeAttr("lay-over")}).off("upload.drop").on("upload.drop",function(n,o){var r=t(this),u=o.originalEvent.dataTransfer.files||[];r.removeAttr("lay-over"),a(u),i.auto?e.upload(u):l(u)}),e.elemFile.off("upload.change").on("upload.change",function(){var t=this.files||[];a(t),i.auto?e.upload():l(t)}),i.bindAction.off("upload.action").on("upload.action",function(){e.upload()}),i.elem.data("haveEvents")||(e.elemFile.on("change",function(){t(this).trigger("upload.change")}),i.elem.on("click",function(){e.isFile()||t(this).trigger("upload.start")}),i.drag&&i.elem.on("dragover",function(e){e.preventDefault(),t(this).trigger("upload.over")}).on("dragleave",function(e){t(this).trigger("upload.leave")}).on("drop",function(e){e.preventDefault(),t(this).trigger("upload.drop",e)}),i.bindAction.on("click",function(){t(this).trigger("upload.action")}),i.elem.data("haveEvents",!0))},a.render=function(e){var t=new p(e);return l.call(t)},e(r,a)});layui.define(["jquery","laytpl","lay"],function(e){"use strict";var i=layui.$,n=layui.laytpl,t=layui.hint(),a=layui.device(),l=a.mobile?"click":"mousedown",r="dropdown",o="layui_"+r+"_index",u={config:{},index:layui[r]?layui[r].index+1e4:0,set:function(e){var n=this;return n.config=i.extend({},n.config,e),n},on:function(e,i){return layui.onevent.call(this,r,e,i)}},d=function(){var e=this,i=e.config,n=i.id;return d.that[n]=e,{config:i,reload:function(i){e.reload.call(e,i)}}},s="layui-dropdown",m="layui-menu-item-up",c="layui-menu-item-down",p="layui-menu-body-title",y="layui-menu-item-group",f="layui-menu-item-parent",v="layui-menu-item-divider",g="layui-menu-item-checked",h="layui-menu-item-checked2",w="layui-menu-body-panel",C="layui-menu-body-panel-left",V="."+y+">."+p,k=function(e){var n=this;n.index=++u.index,n.config=i.extend({},n.config,u.config,e),n.init()};k.prototype.config={trigger:"click",content:"",className:"",style:"",show:!1,isAllowSpread:!0,isSpreadItem:!0,data:[],delay:300},k.prototype.reload=function(e){var n=this;n.config=i.extend({},n.config,e),n.init(!0)},k.prototype.init=function(e){var n=this,t=n.config,a=t.elem=i(t.elem);if(a.length>1)return layui.each(a,function(){u.render(i.extend({},t,{elem:this}))}),n;if(!e&&a[0]&&a.data(o)){var l=d.getThis(a.data(o));if(!l)return;return l.reload(t)}t.id="id"in t?t.id:n.index,t.show&&n.render(e),n.events()},k.prototype.render=function(e){var t=this,a=t.config,r=i("body"),s=function(){var e=i('');return a.data.length>0?m(e,a.data):e.html(''),e},m=function(e,t){return layui.each(t,function(t,l){var r=l.child&&l.child.length>0,o="isSpreadItem"in l?l.isSpreadItem:a.isSpreadItem,u=l.templet?n(l.templet).render(l):a.templet?n(a.templet).render(l):l.title,d=function(){return r&&(l.type=l.type||"parent"),l.type?{group:"group",parent:"parent","-":"-"}[l.type]||"parent":""}();if("-"===d||l.title||l.id||r){var s=i(["",function(){var e="href"in l?''+u+" ":u;return r?''+e+function(){return"parent"===d?'
":''+e+"
"}(),""].join(""));if(s.data("item",l),r){var c=i('
'),y=i("");"parent"===d?(c.append(m(y,l.child)),s.append(c)):s.append(m(y,l.child))}e.append(s)}}),e},c=['',"
"].join("");("contextmenu"===a.trigger||lay.isTopElem(a.elem[0]))&&(e=!0),!e&&a.elem.data(o+"_opened")||(t.elemView=i(c),t.elemView.append(a.content||s()),a.className&&t.elemView.addClass(a.className),a.style&&t.elemView.attr("style",a.style),u.thisId=a.id,t.remove(),r.append(t.elemView),a.elem.data(o+"_opened",!0),t.position(),d.prevElem=t.elemView,d.prevElem.data("prevElem",a.elem),t.elemView.find(".layui-menu").on(l,function(e){lay.stope(e)}),t.elemView.find(".layui-menu li").on("click",function(e){var n=i(this),l=n.data("item")||{},r=l.child&&l.child.length>0;r||"-"===l.type||(t.remove(),"function"==typeof a.click&&a.click(l,n))}),t.elemView.find(V).on("click",function(e){var n=i(this),t=n.parent(),l=t.data("item")||{};"group"===l.type&&a.isAllowSpread&&d.spread(t)}),"mouseenter"===a.trigger&&t.elemView.on("mouseenter",function(){clearTimeout(d.timer)}).on("mouseleave",function(){t.delayRemove()}))},k.prototype.position=function(e){var i=this,n=i.config;lay.position(n.elem[0],i.elemView[0],{position:n.position,e:i.e,clickType:"contextmenu"===n.trigger?"right":null})},k.prototype.remove=function(){var e=this,i=(e.config,d.prevElem);i&&(i.data("prevElem")&&i.data("prevElem").data(o+"_opened",!1),i.remove())},k.prototype.delayRemove=function(){var e=this,i=e.config;clearTimeout(d.timer),d.timer=setTimeout(function(){e.remove()},i.delay)},k.prototype.events=function(){var e=this,i=e.config;"hover"===i.trigger&&(i.trigger="mouseenter"),e.prevElem&&e.prevElem.off(i.trigger,e.prevElemCallback),e.prevElem=i.elem,e.prevElemCallback=function(n){clearTimeout(d.timer),e.e=n,e.render(),n.preventDefault(),"function"==typeof i.ready&&i.ready(e.elemView,i.elem,e.e.target)},i.elem.on(i.trigger,e.prevElemCallback),"mouseenter"===i.trigger&&i.elem.on("mouseleave",function(){e.delayRemove()})},d.that={},d.getThis=function(e){var i=d.that[e];return i||t.error(e?r+" instance with ID '"+e+"' not found":"ID argument required"),i},d.spread=function(e){var i=e.children("."+p).find(".layui-icon");e.hasClass(m)?(e.removeClass(m).addClass(c),i.removeClass("layui-icon-down").addClass("layui-icon-up")):(e.removeClass(c).addClass(m),i.removeClass("layui-icon-up").addClass("layui-icon-down"))},!function(){var e=i(window),n=i(document);e.on("resize",function(){if(u.thisId){var e=d.getThis(u.thisId);if(e){if(!e.elemView[0]||!i("."+s)[0])return!1;var n=e.config;"contextmenu"===n.trigger?e.remove():e.position()}}}),n.on(l,function(e){if(u.thisId){var i=d.getThis(u.thisId);if(i){var n=i.config;!lay.isTopElem(n.elem[0])&&"contextmenu"!==n.trigger&&(e.target===n.elem[0]||n.elem.find(e.target)[0]||e.target===i.elemView[0]||i.elemView&&i.elemView.find(e.target)[0])||i.remove()}}});var t=".layui-menu:not(.layui-dropdown-menu) li";n.on("click",t,function(e){var n=i(this),t=n.parents(".layui-menu").eq(0),a=n.hasClass(y)||n.hasClass(f),l=t.attr("lay-filter")||t.attr("id"),o=lay.options(this);n.hasClass(v)||a||(t.find("."+g).removeClass(g),t.find("."+h).removeClass(h),n.addClass(g),n.parents("."+f).addClass(h),layui.event.call(this,r,"click("+l+")",o))}),n.on("click",t+V,function(e){var n=i(this),t=n.parents("."+y+":eq(0)"),a=lay.options(t[0]);"isAllowSpread"in a&&!a.isAllowSpread||d.spread(t)});var a=".layui-menu ."+f;n.on("mouseenter",a,function(n){var t=i(this),a=t.find("."+w);if(a[0]){var l=a[0].getBoundingClientRect();l.right>e.width()&&(a.addClass(C),l=a[0].getBoundingClientRect(),l.left<0&&a.removeClass(C)),l.bottom>e.height()&&a.eq(0).css("margin-top",-(l.bottom-e.height()))}}).on("mouseleave",a,function(e){var n=i(this),t=n.children("."+w);t.removeClass(C),t.css("margin-top",0)})}(),u.reload=function(e,i){var n=d.getThis(e);return n?(n.reload(i),d.call(n)):this},u.render=function(e){var i=new k(e);return d.call(i)},e(r,u)});layui.define("jquery",function(e){"use strict";var i=layui.jquery,t={config:{},index:layui.slider?layui.slider.index+1e4:0,set:function(e){var t=this;return t.config=i.extend({},t.config,e),t},on:function(e,i){return layui.onevent.call(this,n,e,i)}},a=function(){var e=this,i=e.config;return{setValue:function(t,a){return i.value=t,e.slide("set",t,a||0)},config:i}},n="slider",l="layui-disabled",s="layui-slider",r="layui-slider-bar",o="layui-slider-wrap",u="layui-slider-wrap-btn",d="layui-slider-tips",v="layui-slider-input",c="layui-slider-input-txt",p="layui-slider-input-btn",m="layui-slider-hover",f=function(e){var a=this;a.index=++t.index,a.config=i.extend({},a.config,t.config,e),a.render()};f.prototype.config={type:"default",min:0,max:100,value:0,step:1,showstep:!1,tips:!0,input:!1,range:!1,height:200,disabled:!1,theme:"#009688"},f.prototype.render=function(){var e=this,t=e.config;if(t.step<1&&(t.step=1),t.maxt.min?a:t.min,t.value[1]=n>t.min?n:t.min,t.value[0]=t.value[0]>t.max?t.max:t.value[0],t.value[1]=t.value[1]>t.max?t.max:t.value[1];var r=Math.floor((t.value[0]-t.min)/(t.max-t.min)*100),v=Math.floor((t.value[1]-t.min)/(t.max-t.min)*100),p=v-r+"%";r+="%",v+="%"}else{"object"==typeof t.value&&(t.value=Math.min.apply(null,t.value)),t.valuet.max&&(t.value=t.max);var p=Math.floor((t.value-t.min)/(t.max-t.min)*100)+"%"}var m=t.disabled?"#c2c2c2":t.theme,f=''+(t.tips?'
':"")+'
'+(t.range?'
':"")+"
')}e.elemTemp.append(b)}if(t.input&&!t.range){var w=i('');h.css("position","relative"),h.append(w),h.find("."+c).children("input").val(t.value),"vertical"===t.type?w.css({left:0,top:-48}):e.elemTemp.css("margin-right",w.outerWidth()+15)}t.disabled?(e.elemTemp.addClass(l),e.elemTemp.find("."+u).addClass(l)):e.slide(),e.elemTemp.find("."+u).on("mouseover",function(){var a="vertical"===t.type?t.height:e.elemTemp[0].offsetWidth,n=e.elemTemp.find("."+o),l="vertical"===t.type?a-i(this).parent()[0].offsetTop-n.height():i(this).parent()[0].offsetLeft,s=l/a*100,r=i(this).parent().data("value"),u=t.setTips?t.setTips(r):r;e.elemTemp.find("."+d).html(u),"vertical"===t.type?e.elemTemp.find("."+d).css({bottom:s+"%","margin-bottom":"20px",display:"inline-block"}):e.elemTemp.find("."+d).css({left:s+"%",display:"inline-block"})}).on("mouseout",function(){e.elemTemp.find("."+d).css("display","none")})},f.prototype.slide=function(e,t,a){var n=this,l=n.config,s=n.elemTemp,f=function(){return"vertical"===l.type?l.height:s[0].offsetWidth},h=s.find("."+o),y=s.next("."+v),g=y.children("."+c).children("input").val(),b=100/((l.max-l.min)/Math.ceil(l.step)),x=function(e,i){e=Math.ceil(e)*b>100?Math.ceil(e)*b:Math.round(e)*b,e=e>100?100:e,h.eq(i).css("vertical"===l.type?"bottom":"left",e+"%");var t=T(h[0].offsetLeft),a=l.range?T(h[1].offsetLeft):0;"vertical"===l.type?(s.find("."+d).css({bottom:e+"%","margin-bottom":"20px"}),t=T(f()-h[0].offsetTop-h.height()),a=l.range?T(f()-h[1].offsetTop-h.height()):0):s.find("."+d).css("left",e+"%"),t=t>100?100:t,a=a>100?100:a;var n=Math.min(t,a),o=Math.abs(t-a);"vertical"===l.type?s.find("."+r).css({height:o+"%",bottom:n+"%"}):s.find("."+r).css({width:o+"%",left:n+"%"});var u=l.min+Math.round((l.max-l.min)*e/100);if(g=u,y.children("."+c).children("input").val(g),h.eq(i).data("value",u),s.find("."+d).html(l.setTips?l.setTips(u):u),l.range){var v=[h.eq(0).data("value"),h.eq(1).data("value")];v[0]>v[1]&&v.reverse()}l.change&&l.change(l.range?v:u)},T=function(e){var i=e/f()*100/b,t=Math.round(i)*b;return e==f()&&(t=Math.ceil(i)*b),t},w=i(['f()&&(r=f());var o=r/f()*100/b;x(o,e),t.addClass(m),s.find("."+d).show(),i.preventDefault()},o=function(){t.removeClass(m),s.find("."+d).hide()};M(r,o)})}),s.on("click",function(e){var t=i("."+u);if(!t.is(event.target)&&0===t.has(event.target).length&&t.length){var a,n="vertical"===l.type?f()-e.clientY+i(this).offset().top:e.clientX-i(this).offset().left;n<0&&(n=0),n>f()&&(n=f());var s=n/f()*100/b;a=l.range?"vertical"===l.type?Math.abs(n-parseInt(i(h[0]).css("bottom")))>Math.abs(n-parseInt(i(h[1]).css("bottom")))?1:0:Math.abs(n-h[0].offsetLeft)>Math.abs(n-h[1].offsetLeft)?1:0:0,x(s,a),e.preventDefault()}}),y.children("."+p).children("i").each(function(e){i(this).on("click",function(){g=y.children("."+c).children("input").val(),g=1==e?g-l.step
l.max?l.max:Number(g)+l.step;var i=(g-l.min)/(l.max-l.min)*100/b;x(i,0)})});var q=function(){var e=this.value;e=isNaN(e)?0:e,e=el.max?l.max:e,this.value=e;var i=(e-l.min)/(l.max-l.min)*100/b;x(i,0)};y.children("."+c).children("input").on("keydown",function(e){13===e.keyCode&&(e.preventDefault(),q.call(this))}).on("change",q)},f.prototype.events=function(){var e=this;e.config},t.render=function(e){var i=new f(e);return a.call(i)},e(n,t)});layui.define("jquery",function(e){"use strict";var i=layui.jquery,o={config:{},index:layui.colorpicker?layui.colorpicker.index+1e4:0,set:function(e){var o=this;return o.config=i.extend({},o.config,e),o},on:function(e,i){return layui.onevent.call(this,"colorpicker",e,i)}},r=function(){var e=this,i=e.config;return{config:i}},t="colorpicker",n="layui-show",l="layui-colorpicker",c=".layui-colorpicker-main",a="layui-icon-down",s="layui-icon-close",f="layui-colorpicker-trigger-span",d="layui-colorpicker-trigger-i",u="layui-colorpicker-side",p="layui-colorpicker-side-slider",g="layui-colorpicker-basis",v="layui-colorpicker-alpha-bgcolor",h="layui-colorpicker-alpha-slider",m="layui-colorpicker-basis-cursor",b="layui-colorpicker-main-input",k=function(e){var i={h:0,s:0,b:0},o=Math.min(e.r,e.g,e.b),r=Math.max(e.r,e.g,e.b),t=r-o;return i.b=r,i.s=0!=r?255*t/r:0,0!=i.s?e.r==r?i.h=(e.g-e.b)/t:e.g==r?i.h=2+(e.b-e.r)/t:i.h=4+(e.r-e.g)/t:i.h=-1,r==o&&(i.h=0),i.h*=60,i.h<0&&(i.h+=360),i.s*=100/255,i.b*=100/255,i},y=function(e){var e=e.indexOf("#")>-1?e.substring(1):e;if(3==e.length){var i=e.split("");e=i[0]+i[0]+i[1]+i[1]+i[2]+i[2]}e=parseInt(e,16);var o={r:e>>16,g:(65280&e)>>8,b:255&e};return k(o)},x=function(e){var i={},o=e.h,r=255*e.s/100,t=255*e.b/100;if(0==r)i.r=i.g=i.b=t;else{var n=t,l=(255-r)*t/255,c=(n-l)*(o%60)/60;360==o&&(o=0),o<60?(i.r=n,i.b=l,i.g=l+c):o<120?(i.g=n,i.b=l,i.r=n-c):o<180?(i.g=n,i.r=l,i.b=l+c):o<240?(i.b=n,i.r=l,i.g=n-c):o<300?(i.b=n,i.g=l,i.r=l+c):o<360?(i.r=n,i.g=l,i.b=n-c):(i.r=0,i.g=0,i.b=0)}return{r:Math.round(i.r),g:Math.round(i.g),b:Math.round(i.b)}},C=function(e){var o=x(e),r=[o.r.toString(16),o.g.toString(16),o.b.toString(16)];return i.each(r,function(e,i){1==i.length&&(r[e]="0"+i)}),r.join("")},P=function(e){var i=/[0-9]{1,3}/g,o=e.match(i)||[];return{r:o[0],g:o[1],b:o[2]}},B=i(window),w=i(document),D=function(e){var r=this;r.index=++o.index,r.config=i.extend({},r.config,o.config,e),r.render()};D.prototype.config={color:"",size:null,alpha:!1,format:"hex",predefine:!1,colors:["#009688","#5FB878","#1E9FFF","#FF5722","#FFB800","#01AAED","#999","#c00","#ff8c00","#ffd700","#90ee90","#00ced1","#1e90ff","#c71585","rgb(0, 186, 189)","rgb(255, 120, 0)","rgb(250, 212, 0)","#393D49","rgba(0,0,0,.5)","rgba(255, 69, 0, 0.68)","rgba(144, 240, 144, 0.5)","rgba(31, 147, 255, 0.73)"]},D.prototype.render=function(){var e=this,o=e.config,r=i(['',"",'3&&(o.alpha&&"rgb"==o.format||(e="#"+C(k(P(o.color))))),"background: "+e):e}()+'">',' "," ","
"].join("")),t=i(o.elem);o.size&&r.addClass("layui-colorpicker-"+o.size),t.addClass("layui-inline").html(e.elemColorBox=r),e.color=e.elemColorBox.find("."+f)[0].style.background,e.events()},D.prototype.renderPicker=function(){var e=this,o=e.config,r=e.elemColorBox[0],t=e.elemPicker=i(['','
",'
",function(){if(o.predefine){var e=['
'];return layui.each(o.colors,function(i,o){e.push(['
"].join(""))}),e.push("
"),e.join("")}return""}(),'
','
','
",'
','清空 ','确定 ',"","
"].join(""));e.elemColorBox.find("."+f)[0];i(c)[0]&&i(c).data("index")==e.index?e.removePicker(D.thisElemInd):(e.removePicker(D.thisElemInd),i("body").append(t)),D.thisElemInd=e.index,D.thisColor=r.style.background,e.position(),e.pickerEvents()},D.prototype.removePicker=function(e){var o=this;o.config;return i("#layui-colorpicker"+(e||o.index)).remove(),o},D.prototype.position=function(){var e=this,i=e.config,o=e.bindElem||e.elemColorBox[0],r=e.elemPicker[0],t=o.getBoundingClientRect(),n=r.offsetWidth,l=r.offsetHeight,c=function(e){return e=e?"scrollLeft":"scrollTop",document.body[e]|document.documentElement[e]},a=function(e){return document.documentElement[e?"clientWidth":"clientHeight"]},s=5,f=t.left,d=t.bottom;f-=(n-o.offsetWidth)/2,d+=s,f+n+s>a("width")?f=a("width")-n-s:f
a()&&(d=t.top>l?t.top-l:a()-l,d-=2*s),i.position&&(r.style.position=i.position),r.style.left=f+("fixed"===i.position?0:c(1))+"px",r.style.top=d+("fixed"===i.position?0:c())+"px"},D.prototype.val=function(){var e=this,i=(e.config,e.elemColorBox.find("."+f)),o=e.elemPicker.find("."+b),r=i[0],t=r.style.backgroundColor;if(t){var n=k(P(t)),l=i.attr("lay-type");if(e.select(n.h,n.s,n.b),"torgb"===l&&o.find("input").val(t),"rgba"===l){var c=P(t);if(3==(t.match(/[0-9]{1,3}/g)||[]).length)o.find("input").val("rgba("+c.r+", "+c.g+", "+c.b+", ueditor)"),e.elemPicker.find("."+h).css("left",280);else{o.find("input").val(t);var a=280*t.slice(t.lastIndexOf(",")+1,t.length-1);e.elemPicker.find("."+h).css("left",a)}e.elemPicker.find("."+v)[0].style.background="linear-gradient(to right, rgba("+c.r+", "+c.g+", "+c.b+", 0), rgb("+c.r+", "+c.g+", "+c.b+"))"}}else e.select(0,100,100),o.find("input").val(""),e.elemPicker.find("."+v)[0].style.background="",e.elemPicker.find("."+h).css("left",280)},D.prototype.side=function(){var e=this,o=e.config,r=e.elemColorBox.find("."+f),t=r.attr("lay-type"),n=e.elemPicker.find("."+u),l=e.elemPicker.find("."+p),c=e.elemPicker.find("."+g),y=e.elemPicker.find("."+m),C=e.elemPicker.find("."+v),w=e.elemPicker.find("."+h),D=l[0].offsetTop/180*360,E=100-(y[0].offsetTop+3)/180*100,H=(y[0].offsetLeft+3)/260*100,W=Math.round(w[0].offsetLeft/280*100)/100,j=e.elemColorBox.find("."+d),F=e.elemPicker.find(".layui-colorpicker-pre").children("div"),L=function(i,n,l,c){e.select(i,n,l);var f=x({h:i,s:n,b:l});if(j.addClass(a).removeClass(s),r[0].style.background="rgb("+f.r+", "+f.g+", "+f.b+")","torgb"===t&&e.elemPicker.find("."+b).find("input").val("rgb("+f.r+", "+f.g+", "+f.b+")"),"rgba"===t){var d=0;d=280*c,w.css("left",d),e.elemPicker.find("."+b).find("input").val("rgba("+f.r+", "+f.g+", "+f.b+", "+c+")"),r[0].style.background="rgba("+f.r+", "+f.g+", "+f.b+", "+c+")",C[0].style.background="linear-gradient(to right, rgba("+f.r+", "+f.g+", "+f.b+", 0), rgb("+f.r+", "+f.g+", "+f.b+"))"}o.change&&o.change(e.elemPicker.find("."+b).find("input").val())},M=i(['t&&(r=t);var l=r/180*360;D=l,L(l,H,E,W),e.preventDefault()};Y(r),e.preventDefault()}),n.on("click",function(e){var o=e.clientY-i(this).offset().top;o<0&&(o=0),o>this.offsetHeight&&(o=this.offsetHeight);var r=o/180*360;D=r,L(r,H,E,W),e.preventDefault()}),y.on("mousedown",function(e){var i=this.offsetTop,o=this.offsetLeft,r=e.clientY,t=e.clientX,n=function(e){var n=i+(e.clientY-r),l=o+(e.clientX-t),a=c[0].offsetHeight-3,s=c[0].offsetWidth-3;n<-3&&(n=-3),n>a&&(n=a),l<-3&&(l=-3),l>s&&(l=s);var f=(l+3)/260*100,d=100-(n+3)/180*100;E=d,H=f,L(D,f,d,W),e.preventDefault()};layui.stope(e),Y(n),e.preventDefault()}),c.on("mousedown",function(e){var o=e.clientY-i(this).offset().top-3+B.scrollTop(),r=e.clientX-i(this).offset().left-3+B.scrollLeft();o<-3&&(o=-3),o>this.offsetHeight-3&&(o=this.offsetHeight-3),r<-3&&(r=-3),r>this.offsetWidth-3&&(r=this.offsetWidth-3);var t=(r+3)/260*100,n=100-(o+3)/180*100;E=n,H=t,L(D,t,n,W),e.preventDefault(),y.trigger(e,"mousedown")}),w.on("mousedown",function(e){var i=this.offsetLeft,o=e.clientX,r=function(e){var r=i+(e.clientX-o),t=C[0].offsetWidth;r<0&&(r=0),r>t&&(r=t);var n=Math.round(r/280*100)/100;W=n,L(D,H,E,n),e.preventDefault()};Y(r),e.preventDefault()}),C.on("click",function(e){var o=e.clientX-i(this).offset().left;o<0&&(o=0),o>this.offsetWidth&&(o=this.offsetWidth);var r=Math.round(o/280*100)/100;W=r,L(D,H,E,r),e.preventDefault()}),F.each(function(){i(this).on("click",function(){i(this).parent(".layui-colorpicker-pre").addClass("selected").siblings().removeClass("selected");var e,o=this.style.backgroundColor,r=k(P(o)),t=o.slice(o.lastIndexOf(",")+1,o.length-1);D=r.h,H=r.s,E=r.b,3==(o.match(/[0-9]{1,3}/g)||[]).length&&(t=1),W=t,e=280*t,L(r.h,r.s,r.b,t)})})},D.prototype.select=function(e,i,o,r){var t=this,n=(t.config,C({h:e,s:100,b:100})),l=C({h:e,s:i,b:o}),c=e/360*180,a=180-o/100*180-3,s=i/100*260-3;t.elemPicker.find("."+p).css("top",c),t.elemPicker.find("."+g)[0].style.background="#"+n,t.elemPicker.find("."+m).css({top:a,left:s}),"change"!==r&&t.elemPicker.find("."+b).find("input").val("#"+l)},D.prototype.pickerEvents=function(){var e=this,o=e.config,r=e.elemColorBox.find("."+f),t=e.elemPicker.find("."+b+" input"),n={clear:function(i){r[0].style.background="",e.elemColorBox.find("."+d).removeClass(a).addClass(s),e.color="",o.done&&o.done(""),e.removePicker()},confirm:function(i,n){var l=t.val(),c=l,f={};if(l.indexOf(",")>-1){if(f=k(P(l)),e.select(f.h,f.s,f.b),r[0].style.background=c="#"+C(f),(l.match(/[0-9]{1,3}/g)||[]).length>3&&"rgba"===r.attr("lay-type")){var u=280*l.slice(l.lastIndexOf(",")+1,l.length-1);e.elemPicker.find("."+h).css("left",u),r[0].style.background=l,c=l}}else f=y(l),r[0].style.background=c="#"+C(f),e.elemColorBox.find("."+d).removeClass(s).addClass(a);return"change"===n?(e.select(f.h,f.s,f.b,n),void(o.change&&o.change(c))):(e.color=l,o.done&&o.done(l),void e.removePicker())}};e.elemPicker.on("click","*[colorpicker-events]",function(){var e=i(this),o=e.attr("colorpicker-events");n[o]&&n[o].call(this,e)}),t.on("keyup",function(e){var o=i(this);n.confirm.call(this,o,13===e.keyCode?null:"change")})},D.prototype.events=function(){var e=this,o=e.config,r=e.elemColorBox.find("."+f);e.elemColorBox.on("click",function(){e.renderPicker(),i(c)[0]&&(e.val(),e.side())}),o.elem[0]&&!e.elemColorBox[0].eventHandler&&(w.on("click",function(o){if(!i(o.target).hasClass(l)&&!i(o.target).parents("."+l)[0]&&!i(o.target).hasClass(c.replace(/\./g,""))&&!i(o.target).parents(c)[0]&&e.elemPicker){if(e.color){var t=k(P(e.color));e.select(t.h,t.s,t.b)}else e.elemColorBox.find("."+d).removeClass(a).addClass(s);r[0].style.background=e.color||"",e.removePicker()}}),B.on("resize",function(){return!(!e.elemPicker||!i(c)[0])&&void e.position()}),e.elemColorBox[0].eventHandler=!0)},o.render=function(e){var i=new D(e);return r.call(i)},e(t,o)});layui.define("layer",function(e){"use strict";var t=layui.$,i=layui.layer,a=layui.hint(),n=layui.device(),l="form",r=".layui-form",s="layui-this",o="layui-hide",c="layui-disabled",u=function(){this.config={verify:{required:[/[\S]+/,"必填项不能为空"],phone:[/^1\d{10}$/,"请输入正确的手机号"],email:[/^([a-zA-Z0-9_\.\-])+\@(([a-zA-Z0-9\-])+\.)+([a-zA-Z0-9]{2,4})+$/,"邮箱格式不正确"],url:[/(^#)|(^http(s*):\/\/[^\s]+\.[^\s]+)/,"链接格式不正确"],number:function(e){if(!e||isNaN(e))return"只能填写数字"},date:[/^(\d{4})[-\/](\d{1}|0\d{1}|1[0-2])([-\/](\d{1}|0\d{1}|[1-2][0-9]|3[0-1]))*$/,"日期格式不正确"],identity:[/(^\d{15}$)|(^\d{17}(x|X|\d)$)/,"请输入正确的身份证号"]}}};u.prototype.set=function(e){var i=this;return t.extend(!0,i.config,e),i},u.prototype.verify=function(e){var i=this;return t.extend(!0,i.config.verify,e),i},u.prototype.on=function(e,t){return layui.onevent.call(this,l,e,t)},u.prototype.val=function(e,i){var a=this,n=t(r+'[lay-filter="'+e+'"]');return n.each(function(e,a){var n=t(this);layui.each(i,function(e,t){var i,a=n.find('[name="'+e+'"]');a[0]&&(i=a[0].type,"checkbox"===i?a[0].checked=t:"radio"===i?a.each(function(){this.value==t&&(this.checked=!0)}):a.val(t))})}),f.render(null,e),a.getValue(e)},u.prototype.getValue=function(e,i){i=i||t(r+'[lay-filter="'+e+'"]').eq(0);var a={},n={},l=i.find("input,select,textarea");return layui.each(l,function(e,t){if(t.name=(t.name||"").replace(/^\s*|\s*&/,""),t.name){if(/^.*\[\]$/.test(t.name)){var i=t.name.match(/^(.*)\[\]$/g)[0];a[i]=0|a[i],t.name=t.name.replace(/^(.*)\[\]$/,"$ueditor["+a[i]++ +"]")}/^checkbox|radio$/.test(t.type)&&!t.checked||(n[t.name]=t.value)}}),n},u.prototype.render=function(e,i){var n=this,u=t(r+function(){return i?'[lay-filter="'+i+'"]':""}()),d={select:function(){var e,i="请选择",a="layui-form-select",n="layui-select-title",r="layui-select-none",d="",f=u.find("select"),v=function(i,l){t(i.target).parent().hasClass(n)&&!l||(t("."+a).removeClass(a+"ed "+a+"up"),e&&d&&e.val(d)),e=null},y=function(i,u,f){var y,p=t(this),m=i.find("."+n),k=m.find("input"),g=i.find("dl"),x=g.children("dd"),b=this.selectedIndex;if(!u){var C=function(){var e=i.offset().top+i.outerHeight()+5-h.scrollTop(),t=g.outerHeight();b=p[0].selectedIndex,i.addClass(a+"ed"),x.removeClass(o),y=null,x.eq(b).addClass(s).siblings().removeClass(s),e+t>h.height()&&e>=t&&i.addClass(a+"up"),T()},w=function(e){i.removeClass(a+"ed "+a+"up"),k.blur(),y=null,e||$(k.val(),function(e){var i=p[0].selectedIndex;e&&(d=t(p[0].options[i]).html(),0===i&&d===k.attr("placeholder")&&(d=""),k.val(d||""))})},T=function(){var e=g.children("dd."+s);if(e[0]){var t=e.position().top,i=g.height(),a=e.height();t>i&&g.scrollTop(t+g.scrollTop()-i+a-5),t<0&&g.scrollTop(t+g.scrollTop()-5)}};m.on("click",function(e){i.hasClass(a+"ed")?w():(v(e,!0),C()),g.find("."+r).remove()}),m.find(".layui-edge").on("click",function(){k.focus()}),k.on("keyup",function(e){var t=e.keyCode;9===t&&C()}).on("keydown",function(e){var t=e.keyCode;9===t&&w();var i=function(t,a){var n,l;e.preventDefault();var r=function(){var e=g.children("dd."+s);if(g.children("dd."+o)[0]&&"next"===t){var i=g.children("dd:not(."+o+",."+c+")"),n=i.eq(0).index();if(n>=0&&n
无匹配项'):g.find("."+r).remove()},"keyup"),""===t&&g.find("."+r).remove(),void T())};f&&k.on("keyup",q).on("blur",function(i){var a=p[0].selectedIndex;e=k,d=t(p[0].options[a]).html(),0===a&&d===k.attr("placeholder")&&(d=""),setTimeout(function(){$(k.val(),function(e){d||k.val("")},"blur")},200)}),x.on("click",function(){var e=t(this),a=e.attr("lay-value"),n=p.attr("lay-filter");return!e.hasClass(c)&&(e.hasClass("layui-select-tips")?k.val(""):(k.val(e.text()),e.addClass(s)),e.siblings().removeClass(s),p.val(a).removeClass("layui-form-danger"),layui.event.call(this,l,"select("+n+")",{elem:p[0],value:a,othis:i}),w(!0),!1)}),i.find("dl>dt").on("click",function(e){return!1}),t(document).off("click",v).on("click",v)}};f.each(function(e,l){var r=t(this),o=r.next("."+a),u=this.disabled,d=l.value,f=t(l.options[l.selectedIndex]),v=l.options[0];if("string"==typeof r.attr("lay-ignore"))return r.show();var h="string"==typeof r.attr("lay-search"),p=v?v.value?i:v.innerHTML||i:i,m=t(['','
','
','
',function(e){var t=[];return layui.each(e,function(e,a){0!==e||a.value?"optgroup"===a.tagName.toLowerCase()?t.push(""+a.label+" "):t.push(''+a.innerHTML+" "):t.push(''+(a.innerHTML||i)+" ")}),0===t.length&&t.push('没有选项 '),t.join("")}(r.find("*"))+" ","
",function(){var e=n.title.replace(/\s/g,""),t={checkbox:[e?""+n.title+" ":"",'"+((n.checked?s[0]:s[1])||"")+"
"].join(""));d[0]&&d.remove(),l.after(f),a.call(this,f,u)})},radio:function(){var e="layui-form-radio",i=["",""],a=u.find("input[type=radio]"),n=function(a){var n=t(this),s="layui-anim-scaleSpring";a.on("click",function(){var o=n[0].name,c=n.parents(r),u=n.attr("lay-filter"),d=c.find("input[name="+o.replace(/(\.|#|\[|\])/g,"\\$ueditor")+"]");n[0].disabled||(layui.each(d,function(){var a=t(this).next("."+e);this.checked=!1,a.removeClass(e+"ed"),a.find(".layui-icon").removeClass(s).html(i[1])}),n[0].checked=!0,a.addClass(e+"ed"),a.find(".layui-icon").addClass(s).html(i[0]),layui.event.call(n[0],l,"radio("+u+")",{elem:n[0],value:n[0].value,othis:a}))})};a.each(function(a,l){var r=t(this),s=r.next("."+e),o=this.disabled;if("string"==typeof r.attr("lay-ignore"))return r.show();s[0]&&s.remove();var u=t(['','
'+i[l.checked?0:1]+" ","
"+function(){var e=l.title||"";return"string"==typeof r.next().attr("lay-radio")&&(e=r.next().html(),r.next().remove()),e}()+"
","
');e.tree(n);var t=a.elem=i(a.elem);if(t[0]){if(e.key=a.id||e.index,e.elem=n,e.elemNone=i(''+a.text.none+"
"),t.html(e.elem),0==e.elem.find(".layui-tree-set").length)return e.elem.append(e.elemNone);a.showCheckbox&&e.renderForm("checkbox"),e.elem.find(".layui-tree-set").each(function(){var e=i(this);e.parent(".layui-tree-pack")[0]||e.addClass("layui-tree-setHide"),!e.next()[0]&&e.parents(".layui-tree-pack").eq(1).hasClass("layui-tree-lineExtend")&&e.addClass(k),e.next()[0]||e.parents(".layui-tree-set").eq(0).next()[0]||e.addClass(k)}),e.events()}},b.prototype.renderForm=function(e){a.render(e,"LAY-tree-"+this.index)},b.prototype.tree=function(e,a){var n=this,t=n.config,r=a||t.data;layui.each(r,function(a,r){var l=r.children&&r.children.length>0,o=i('
"),h=i(['','
','
',function(){return t.showLine?l?'
':'
':'
'}(),function(){return t.showCheckbox?'
':""}(),function(){return t.isJump&&r.href?'
'+(r.title||r.label||t.text.defaultNodeName)+" ":'
'+(r.title||r.label||t.text.defaultNodeName)+" "}(),"
",function(){if(!t.edit)return"";var e={add:'
',update:'
',del:'
'},i=['
'];return t.edit===!0&&(t.edit=["update","del"]),"object"==typeof t.edit?(layui.each(t.edit,function(a,n){i.push(e[n]||"")}),i.join("")+"
"):void 0}(),"
'));var w=r.operate&&r.operate(g),N={};if(N.title=r.text.defaultNodeName,N.id=w,t.tree(e.children("."+v),[N]),r.showLine)if(b[0])b.hasClass(x)||b.addClass(x),e.find("."+v).each(function(){i(this).children("."+s).last().addClass(k)}),b.children("."+s).last().prev().hasClass(k)?b.children("."+s).last().prev().removeClass(k):b.children("."+s).last().removeClass(k),!e.parent("."+v)[0]&&e.next()[0]&&b.children("."+s).last().removeClass(k);else{var T=e.siblings("."+s),L=1,A=e.parent("."+v);layui.each(T,function(e,a){i(a).children("."+v)[0]||(L=0)}),1==L?(T.children("."+v).addClass(m),T.children("."+v).children("."+s).removeClass(k),e.children("."+v).addClass(m),A.removeClass(x),A.children("."+s).last().children("."+v).children("."+s).last().addClass(k)):e.children("."+v).children("."+s).addClass(k)}if(!r.showCheckbox)return;if(d.find('input[same="layuiTreeCheck"]')[0].checked){var I=e.children("."+v).children("."+s).last();I.find('input[same="layuiTreeCheck"]')[0].checked=!0}t.renderForm("checkbox")}else if("update"==f){var F=d.children("."+y).html();d.children("."+y).html(""),d.append(''+(a.title||"")+' " 吗？',function(a){if(r.operate&&r.operate(g),g.status="remove",n.close(a),!e.prev("."+s)[0]&&!e.next("."+s)[0]&&!e.parent("."+v)[0])return e.remove(),void t.elem.append(t.elemNone);if(e.siblings("."+s).children("."+p)[0]){if(r.showCheckbox){var l=function(e){if(e.parents("."+s)[0]){var a=e.siblings("."+s).children("."+p),n=e.parent("."+v).prev(),r=n.find('input[same="layuiTreeCheck"]')[0],c=1,d=0;0==r.checked&&(a.each(function(e,a){var n=i(a).find('input[same="layuiTreeCheck"]')[0];0!=n.checked||n.disabled||(c=0),n.disabled||(d=1)}),1==c&&1==d&&(r.checked=!0,t.renderForm("checkbox"),l(n.parent("."+s))))}};l(e)}if(r.showLine){var d=e.siblings("."+s),h=1,f=e.parent("."+v);layui.each(d,function(e,a){i(a).children("."+v)[0]||(h=0)}),1==h?(b[0]||(f.removeClass(x),d.children("."+v).addClass(m),d.children("."+v).children("."+s).removeClass(k)),e.next()[0]?f.children("."+s).last().children("."+v).children("."+s).last().addClass(k):e.prev().children("."+v).children("."+s).last().addClass(k),e.next()[0]||e.parents("."+s)[1]||e.parents("."+s).eq(0).next()[0]||e.prev("."+s).addClass(k)):!e.next()[0]&&e.hasClass(k)&&e.prev().addClass(k)}}else{var y=e.parent("."+v).prev();if(r.showLine){y.find("."+o).removeClass("layui-tree-icon"),y.find("."+o).children(".layui-icon").removeClass(u).addClass("layui-icon-file");var w=y.parents("."+v).eq(0);w.addClass(x),w.children("."+s).each(function(){i(this).children("."+v).children("."+s).last().addClass(k)})}else y.find(".layui-tree-iconArrow").addClass(c);e.parents("."+s).eq(0).removeClass(C),e.parent("."+v).remove()}e.remove()})})},b.prototype.events=function(){var e=this,a=e.config;e.elem.find(".layui-tree-checkedFirst");e.setChecked(e.checkids),e.elem.find(".layui-tree-search").on("keyup",function(){var n=i(this),t=n.val(),r=n.nextAll(),l=[];r.find("."+y).each(function(){var e=i(this).parents("."+p);if(i(this).html().indexOf(t)!=-1){l.push(i(this).parent());var a=function(e){e.addClass("layui-tree-searchShow"),e.parent("."+v)[0]&&a(e.parent("."+v).parent("."+s))};a(e.parent("."+s))}}),r.find("."+p).each(function(){var e=i(this).parent("."+s);e.hasClass("layui-tree-searchShow")||e.addClass(c)}),0==r.find(".layui-tree-searchShow").length&&e.elem.append(e.elemNone),a.onsearch&&a.onsearch({elem:l})}),e.elem.find(".layui-tree-search").on("keydown",function(){i(this).nextAll().find("."+p).each(function(){var e=i(this).parent("."+s);e.removeClass("layui-tree-searchShow "+c)}),i(".layui-tree-emptyText")[0]&&i(".layui-tree-emptyText").remove()})},b.prototype.getChecked=function(){var e=this,a=e.config,n=[],t=[];e.elem.find(".layui-form-checked").each(function(){n.push(i(this).prev()[0].value)});var r=function(e,a){layui.each(e,function(e,t){layui.each(n,function(e,n){if(t.id==n){var l=i.extend({},t);return delete l.children,a.push(l),t.children&&(l.children=[],r(t.children,l.children)),!0}})})};return r(i.extend({},a.data),t),t},b.prototype.setChecked=function(e){var a=this;a.config;a.elem.find("."+s).each(function(a,n){var t=i(this).data("id"),r=i(n).children("."+p).find('input[same="layuiTreeCheck"]'),l=r.next();if("number"==typeof e){if(t==e)return r[0].checked||l.click(),!1}else"object"==typeof e&&layui.each(e,function(e,i){if(i==t&&!r[0].checked)return l.click(),!0})})},l.that={},l.config={},r.reload=function(e,i){var a=l.that[e];return a.reload(i),l.call(a)},r.getChecked=function(e){var i=l.that[e];return i.getChecked()},r.setChecked=function(e,i){var a=l.that[e];return a.setChecked(i)},r.render=function(e){var i=new b(e);return l.call(i)},e(t,r)});layui.define(["laytpl","form"],function(e){"use strict";var a=layui.$,t=layui.laytpl,i=layui.form,n="transfer",l={config:{},index:layui[n]?layui[n].index+1e4:0,set:function(e){var t=this;return t.config=a.extend({},t.config,e),t},on:function(e,a){return layui.onevent.call(this,n,e,a)}},r=function(){var e=this,a=e.config,t=a.id||e.index;return r.that[t]=e,r.config[t]=a,{config:a,reload:function(a){e.reload.call(e,a)},getData:function(){return e.getData.call(e)}}},c="layui-hide",o="layui-btn-disabled",d="layui-none",s="layui-transfer-box",u="layui-transfer-header",h="layui-transfer-search",f="layui-transfer-active",y="layui-transfer-data",p=function(e){return e=e||{},['','","{{# if(d.data.showSearch){ }}",'
','
","{{# } }}",'
',"
",' "].join("");a[t].views.push(i),delete e.selected}),e.layData.eq(0).html(a[0].views.join("")),e.layData.eq(1).html(a[1].views.join("")),e.renderCheckBtn()},x.prototype.renderForm=function(e){i.render(e,"LAY-transfer-"+this.index)},x.prototype.renderCheckBtn=function(e){var t=this,i=t.config;e=e||{},t.layBox.each(function(n){var l=a(this),r=l.find("."+y),d=l.find("."+u).find('input[type="checkbox"]'),s=r.find('input[type="checkbox"]'),h=0,f=!1;if(s.each(function(){var e=a(this).data("hide");(this.checked||this.disabled||e)&&h++,this.checked&&!e&&(f=!0)}),d.prop("checked",f&&h===s.length),t.layBtn.eq(n)[f?"removeClass":"addClass"](o),!e.stopNone){var p=r.children("li:not(."+c+")").length;t.noneView(r,p?"":i.text.none)}}),t.renderForm("checkbox")},x.prototype.noneView=function(e,t){var i=a(''+(t||"")+"
");e.find("."+d)[0]&&e.find("."+d).remove(),t.replace(/\s/g,"")&&e.append(i)},x.prototype.setValue=function(){var e=this,t=e.config,i=[];return e.layBox.eq(1).find("."+y+' input[type="checkbox"]').each(function(){var e=a(this).data("hide");e||i.push(this.value)}),t.value=i,e},x.prototype.parseData=function(e){var t=this,i=t.config,n=[];return layui.each(i.data,function(t,l){l=("function"==typeof i.parseData?i.parseData(l):l)||l,n.push(l=a.extend({},l)),layui.each(i.value,function(e,a){a==l.value&&(l.selected=!0)}),e&&e(l)}),i.data=n,t},x.prototype.getData=function(e){var a=this,t=a.config,i=[];return a.setValue(),layui.each(e||t.value,function(e,a){layui.each(t.data,function(e,t){delete t.selected,a==t.value&&i.push(t)})}),i},x.prototype.events=function(){var e=this,t=e.config;e.elem.on("click",'input[lay-filter="layTransferCheckbox"]+',function(){var t=a(this).prev(),i=t[0].checked,n=t.parents("."+s).eq(0).find("."+y);t[0].disabled||("all"===t.attr("lay-type")&&n.find('input[type="checkbox"]').each(function(){this.disabled||(this.checked=i)}),e.renderCheckBtn({stopNone:!0}))}),e.layBtn.on("click",function(){var i=a(this),n=i.data("index"),l=e.layBox.eq(n),r=[];if(!i.hasClass(o)){e.layBox.eq(n).each(function(t){var i=a(this),n=i.find("."+y);n.children("li").each(function(){var t=a(this),i=t.find('input[type="checkbox"]'),n=i.data("hide");i[0].checked&&!n&&(i[0].checked=!1,l.siblings("."+s).find("."+y).append(t.clone()),t.remove(),r.push(i[0].value)),e.setValue()})}),e.renderCheckBtn();var c=l.siblings("."+s).find("."+h+" input");""===c.val()||c.trigger("keyup"),t.onchange&&t.onchange(e.getData(r),n)}}),e.laySearch.find("input").on("keyup",function(){var i=this.value,n=a(this).parents("."+h).eq(0).siblings("."+y),l=n.children("li");l.each(function(){var e=a(this),t=e.find('input[type="checkbox"]'),n=t[0].title.indexOf(i)!==-1;e[n?"removeClass":"addClass"](c),t.data("hide",!n)}),e.renderCheckBtn();var r=l.length===n.children("li."+c).length;e.noneView(n,r?t.text.searchNone:"")})},r.that={},r.config={},l.reload=function(e,a){var t=r.that[e];return t.reload(a),r.call(t)},l.getData=function(e){var a=r.that[e];return a.getData()},l.render=function(e){var a=new x(e);return r.call(a)},e(n,l)});layui.define(["laytpl","laypage","layer","form","util"],function(e){"use strict";var t=layui.$,i=layui.laytpl,a=layui.laypage,l=layui.layer,n=layui.form,o=(layui.util,layui.hint()),r=layui.device(),d={config:{checkName:"LAY_CHECKED",indexName:"LAY_TABLE_INDEX"},cache:{},index:layui.table?layui.table.index+1e4:0,set:function(e){var i=this;return i.config=t.extend({},i.config,e),i},on:function(e,t){return layui.onevent.call(this,y,e,t)}},c=function(){var e=this,t=e.config,i=t.id||t.index;return i&&(c.that[i]=e,c.config[i]=t),{config:t,reload:function(t,i){e.reload.call(e,t,i)},setColsWidth:function(){e.setColsWidth.call(e)},resize:function(){e.resize.call(e)}}},s=function(e){var t=c.config[e];return t||o.error(e?"The table instance with ID '"+e+"' not found":"ID argument required"),t||null},u=function(e,a,l,n){var o=e.templet?function(){return"function"==typeof e.templet?e.templet(l):i(t(e.templet).html()||String(a)).render(l)}():a;return n?t(""+o+"
").text():o},y="table",h=".layui-table",f="layui-hide",p="layui-none",v="layui-table-view",m=".layui-table-tool",g=".layui-table-box",b=".layui-table-init",x=".layui-table-header",k=".layui-table-body",C=".layui-table-main",w=".layui-table-fixed",T=".layui-table-fixed-l",N=".layui-table-fixed-r",A=".layui-table-total",L=".layui-table-page",S=".layui-table-sort",R="layui-table-edit",W="layui-table-hover",_=function(e){var t='{{#if(item2.colspan){}} colspan="{{item2.colspan}}"{{#} if(item2.rowspan){}} rowspan="{{item2.rowspan}}"{{#}}}';return e=e||{},['',"","{{# layui.each(d.data.cols, function(i1, item1){ }}","","{{# layui.each(item1, function(i2, item2){ }}",'{{# if(item2.fixed && item2.fixed !== "right"){ left = true; } }}','{{# if(item2.fixed === "right"){ right = true; } }}',function(){return e.fixed&&"right"!==e.fixed?'{{# if(item2.fixed && item2.fixed !== "right"){ }}':"right"===e.fixed?'{{# if(item2.fixed === "right"){ }}':""}(),"{{# var isSort = !(item2.colGroup) && item2.sort; }}",'','','{{# if(item2.type === "checkbox"){ }}','{{item2.title||""}} ',"{{# if(isSort){ }}",'
"," ",e.fixed?"{{# }; }}":"","{{# }); }}"," ","{{# }); }}"," ","
"].join("")},z=['"].join(""),E=['"].join(""),j=t(window),F=t(document),I=function(e){var i=this;i.index=++d.index,i.config=t.extend({},i.config,d.config,e),i.render()};I.prototype.config={limit:10,loading:!0,cellMinWidth:60,defaultToolbar:["filter","exports","print"],autoSort:!0,text:{none:"无数据"}},I.prototype.render=function(){var e=this,a=e.config;if(a.elem=t(a.elem),a.where=a.where||{},a.id=a.id||a.elem.attr("id")||e.index,a.request=t.extend({pageName:"page",limitName:"limit"},a.request),a.response=t.extend({statusName:"code",statusCode:0,msgName:"msg",dataName:"data",totalRowName:"totalRow",countName:"count"},a.response),"object"==typeof a.page&&(a.limit=a.page.limit||a.limit,a.limits=a.page.limits||a.limits,e.page=a.page.curr=a.page.curr||1,delete a.page.elem,delete a.page.jump),!a.elem[0])return e;a.height&&/^full-\d+$/.test(a.height)&&(e.fullHeightGap=a.height.split("-")[1],a.height=j.height()-e.fullHeightGap),e.setInit();var l=a.elem,n=l.next("."+v),o=e.elem=t(i(E).render({VIEW_CLASS:v,data:a,index:e.index}));if(a.index=e.index,e.key=a.id||a.index,n[0]&&n.remove(),l.after(o),e.layTool=o.find(m),e.layBox=o.find(g),e.layHeader=o.find(x),e.layMain=o.find(C),e.layBody=o.find(k),e.layFixed=o.find(w),e.layFixLeft=o.find(T),e.layFixRight=o.find(N),e.layTotal=o.find(A),e.layPage=o.find(L),e.renderToolbar(),e.fullSize(),a.cols.length>1){var r=e.layFixed.find(x).find("th");r.height(e.layHeader.height()-1-parseFloat(r.css("padding-top"))-parseFloat(r.css("padding-bottom")))}e.pullData(e.page),e.events()},I.prototype.initOpts=function(e){var t=this,i=(t.config,{checkbox:48,radio:48,space:15,numbers:40});e.checkbox&&(e.type="checkbox"),e.space&&(e.type="space"),e.type||(e.type="normal"),"normal"!==e.type&&(e.unresize=!0,e.width=e.width||i[e.type])},I.prototype.setInit=function(e){var t=this,i=t.config;return i.clientWidth=i.width||function(){var e=function(t){var a,l;t=t||i.elem.parent(),a=t.width();try{l="none"===t.css("display")}catch(n){}return!t[0]||a&&!l?a:e(t.parent())};return e()}(),"width"===e?i.clientWidth:void layui.each(i.cols,function(e,a){layui.each(a,function(l,n){if(!n)return void a.splice(l,1);if(n.key=e+"-"+l,n.hide=n.hide||!1,n.colGroup||n.colspan>1){var o=0;layui.each(i.cols[e+1],function(t,i){i.HAS_PARENT||o>1&&o==n.colspan||(i.HAS_PARENT=!0,i.parentKey=e+"-"+l,o+=parseInt(i.colspan>1?i.colspan:1))}),n.colGroup=!0}t.initOpts(n)})})},I.prototype.renderToolbar=function(){var e=this,a=e.config,l=['
','
','
'].join(""),n=e.layTool.find(".layui-table-tool-temp");if("default"===a.toolbar)n.html(l);else if("string"==typeof a.toolbar){var o=t(a.toolbar).html()||"";o&&n.html(i(o).render(a))}var r={filter:{title:"筛选列",layEvent:"LAYTABLE_COLS",icon:"layui-icon-cols"},exports:{title:"导出",layEvent:"LAYTABLE_EXPORT",icon:"layui-icon-export"},print:{title:"打印",layEvent:"LAYTABLE_PRINT",icon:"layui-icon-print"}},d=[];"object"==typeof a.defaultToolbar&&layui.each(a.defaultToolbar,function(e,t){var i="string"==typeof t?r[t]:t;i&&d.push('
')}),e.layTool.find(".layui-table-tool-self").html(d.join(""))},I.prototype.setParentCol=function(e,t){var i=this,a=i.config,l=i.layHeader.find('th[data-key="'+a.index+"-"+t+'"]'),n=parseInt(l.attr("colspan"))||0;if(l[0]){var o=t.split("-"),r=a.cols[o[0]][o[1]];e?n--:n++,l.attr("colspan",n),l[n<1?"addClass":"removeClass"](f),r.colspan=n,r.hide=n<1;var d=l.data("parentkey");d&&i.setParentCol(e,d)}},I.prototype.setColsPatch=function(){var e=this,t=e.config;layui.each(t.cols,function(t,i){layui.each(i,function(t,i){i.hide&&e.setParentCol(i.hide,i.parentKey)})})},I.prototype.setColsWidth=function(){var e=this,t=e.config,i=0,a=0,l=0,n=0,o=e.setInit("width");e.eachCols(function(e,t){t.hide||i++}),o=o-function(){return"line"===t.skin||"nob"===t.skin?2:i+1}()-e.getScrollWidth(e.layMain[0])-1;var r=function(e){layui.each(t.cols,function(i,r){layui.each(r,function(i,d){var c=0,s=d.minWidth||t.cellMinWidth;return d?void(d.colGroup||d.hide||(e?l&&ln&&a&&(l=(o-n)/a)};r(),r(!0),e.autoColNums=a,e.eachCols(function(i,a){var n=a.minWidth||t.cellMinWidth;a.colGroup||a.hide||(0===a.width?e.getCssRule(t.index+"-"+a.key,function(e){e.style.width=Math.floor(l>=n?l:n)+"px"}):/\d+%$/.test(a.width)&&e.getCssRule(t.index+"-"+a.key,function(e){e.style.width=Math.floor(parseFloat(a.width)/100*o)+"px"}))});var d=e.layMain.width()-e.getScrollWidth(e.layMain[0])-e.layMain.children("table").outerWidth();if(e.autoColNums&&d>=-i&&d<=i){var c=function(t){var i;return t=t||e.layHeader.eq(0).find("thead th:last-child"),i=t.data("field"),!i&&t.prev()[0]?c(t.prev()):t},s=c(),u=s.data("key");e.getCssRule(u,function(t){var i=t.style.width||s.outerWidth();t.style.width=parseFloat(i)+d+"px",e.layMain.height()-e.layMain.prop("clientHeight")>0&&(t.style.width=parseFloat(t.style.width)-1+"px")})}e.loading(!0)},I.prototype.resize=function(){var e=this;e.fullSize(),e.setColsWidth(),e.scrollPatch()},I.prototype.reload=function(e,i){var a=this;e=e||{},delete a.haveInit,e.data&&e.data.constructor===Array&&delete a.config.data,a.config=t.extend(i,{},a.config,e),a.render()},I.prototype.errorView=function(e){var i=this,a=i.layMain.find("."+p),l=t(''+(e||"Error")+"
");a[0]&&(i.layNone.remove(),a.remove()),i.layFixed.addClass(f),i.layMain.find("tbody").html(""),i.layMain.append(i.layNone=l),d.cache[i.key]=[]},I.prototype.page=1,I.prototype.pullData=function(e){var i=this,a=i.config,l=a.request,n=a.response,o=function(){"object"==typeof a.initSort&&i.sort(a.initSort.field,a.initSort.type)};if(i.startTime=(new Date).getTime(),a.url){var r={};r[l.pageName]=e,r[l.limitName]=a.limit;var d=t.extend(r,a.where);a.contentType&&0==a.contentType.indexOf("application/json")&&(d=JSON.stringify(d)),i.loading(),t.ajax({type:a.method||"get",url:a.url,contentType:a.contentType,data:d,dataType:"json",headers:a.headers||{},success:function(t){"function"==typeof a.parseData&&(t=a.parseData(t)||t),t[n.statusName]!=n.statusCode?(i.renderForm(),i.errorView(t[n.msgName]||'返回的数据不符合规范，正确的成功状态码应为："'+n.statusName+'": '+n.statusCode)):(i.renderData(t,e,t[n.countName]),o(),a.time=(new Date).getTime()-i.startTime+" ms"),i.setColsWidth(),"function"==typeof a.done&&a.done(t,e,t[n.countName])},error:function(e,t){i.errorView("数据接口请求异常："+t),i.renderForm(),i.setColsWidth(),"function"==typeof a.error&&a.error(e,t)}})}else if(a.data&&a.data.constructor===Array){var c={},s=e*a.limit-a.limit;c[n.dataName]=a.data.concat().splice(s,a.limit),c[n.countName]=a.data.length,"object"==typeof a.totalRow&&(c[n.totalRowName]=t.extend({},a.totalRow)),i.renderData(c,e,c[n.countName]),o(),i.setColsWidth(),"function"==typeof a.done&&a.done(c,e,c[n.countName])}},I.prototype.eachCols=function(e){var t=this;return d.eachCols(null,e,t.config.cols),t},I.prototype.renderData=function(e,n,o,r){var c=this,s=c.config,y=e[s.response.dataName]||[],h=e[s.response.totalRowName],v=[],m=[],g=[],b=function(){var e;return!r&&c.sortKey?c.sort(c.sortKey.field,c.sortKey.sort,!0):(layui.each(y,function(a,l){var o=[],y=[],h=[],p=a+s.limit*(n-1)+1;0!==l.length&&(r||(l[d.config.indexName]=a),c.eachCols(function(n,r){var c=r.field||n,v=s.index+"-"+r.key,m=l[c];if(void 0!==m&&null!==m||(m=""),!r.colGroup){var g=['',''+function(){var n=t.extend(!0,{LAY_INDEX:p},l),o=d.config.checkName;switch(r.type){case"checkbox":return'
"].join("");o.push(g),r.fixed&&"right"!==r.fixed&&y.push(g),"right"===r.fixed&&h.push(g)}}),v.push(''+o.join("")+" "),m.push(''+y.join("")+" "),g.push(''+h.join("")+" "))}),c.layBody.scrollTop(0),c.layMain.find("."+p).remove(),c.layMain.find("tbody").html(v.join("")),c.layFixLeft.find("tbody").html(m.join("")),c.layFixRight.find("tbody").html(g.join("")),c.renderForm(),"number"==typeof e&&c.setThisRowChecked(e),c.syncCheckAll(),c.haveInit?c.scrollPatch():setTimeout(function(){c.scrollPatch()},50),c.haveInit=!0,l.close(c.tipsIndex),s.HAS_SET_COLS_PATCH||c.setColsPatch(),void(s.HAS_SET_COLS_PATCH=!0))};return d.cache[c.key]=y,c.layPage[0==o||0===y.length&&1==n?"addClass":"removeClass"](f),0===y.length?(c.renderForm(),c.errorView(s.text.none)):(c.layFixed.removeClass(f),r?b():(b(),c.renderTotal(y,h),void(s.page&&(s.page=t.extend({elem:"layui-table-page"+s.index,count:o,limit:s.limit,limits:s.limits||[10,20,30,40,50,60,70,80,90],groups:3,layout:["prev","page","next","skip","count","limit"],prev:' ',next:' ',jump:function(e,t){t||(c.page=e.curr,s.limit=e.limit,c.pullData(e.curr))}},s.page),s.page.count=o,a.render(s.page)))))},I.prototype.renderTotal=function(e,a){var l=this,n=l.config,o={};if(n.totalRow){layui.each(e,function(e,t){0!==t.length&&l.eachCols(function(e,i){var a=i.field||e,l=t[a];i.totalRow&&(o[a]=(o[a]||0)+(parseFloat(l)||0))})}),l.dataTotal={};var r=[];l.eachCols(function(e,d){var c=d.field||e,s=function(){var e=d.totalRowText||"",t=parseFloat(o[c]).toFixed(2),i={};return i[c]=t,t=u(d,t,i),a?a[d.field]||e:d.totalRow?t||e:e}(),y=['',''+function(){var e=d.totalRow||n.totalRow;return"string"==typeof e?i(e).render(t.extend({TOTAL_NUMS:s},d)):s}(),"
"].join("");d.field&&(l.dataTotal[c]=s),r.push(y)}),l.layTotal.find("tbody").html(""+r.join("")+" ")}},I.prototype.getColElem=function(e,t){var i=this,a=i.config;return e.eq(0).find(".laytable-cell-"+(a.index+"-"+t)+":eq(0)")},I.prototype.renderForm=function(e){n.render(e,"LAY-table-"+this.index)},I.prototype.setThisRowChecked=function(e){var t=this,i=(t.config,"layui-table-click"),a=t.layBody.find('tr[data-index="'+e+'"]');a.addClass(i).siblings("tr").removeClass(i)},I.prototype.sort=function(e,i,a,l){var n,r,c=this,s={},u=c.config,h=u.elem.attr("lay-filter"),f=d.cache[c.key];"string"==typeof e&&(n=e,c.layHeader.find("th").each(function(i,a){var l=t(this),o=l.data("field");if(o===e)return e=l,n=o,!1}));try{var n=n||e.data("field"),p=e.data("key");if(c.sortKey&&!a&&n===c.sortKey.field&&i===c.sortKey.sort)return;var v=c.layHeader.find("th .laytable-cell-"+p).find(S);c.layHeader.find("th").find(S).removeAttr("lay-sort"),v.attr("lay-sort",i||null),c.layFixed.find("th")}catch(m){o.error("Table modules: sort field '"+n+"' not matched")}c.sortKey={field:n,sort:i},u.autoSort&&("asc"===i?r=layui.sort(f,n):"desc"===i?r=layui.sort(f,n,!0):(r=layui.sort(f,d.config.indexName),delete c.sortKey)),s[u.response.dataName]=r||f,c.renderData(s,c.page,c.count,!0),l&&layui.event.call(e,y,"sort("+h+")",{field:n,type:i})},I.prototype.loading=function(e){var i=this,a=i.config;a.loading&&(e?(i.layInit&&i.layInit.remove(),delete i.layInit,i.layBox.find(b).remove()):(i.layInit=t(['','
"].join("")),i.layBox.append(i.layInit)))},I.prototype.setCheckData=function(e,t){var i=this,a=i.config,l=d.cache[i.key];l[e]&&l[e].constructor!==Array&&(l[e][a.checkName]=t)},I.prototype.syncCheckAll=function(){var e=this,t=e.config,i=e.layHeader.find('input[name="layTableCheckbox"]'),a=function(i){return e.eachCols(function(e,a){"checkbox"===a.type&&(a[t.checkName]=i)}),i};i[0]&&(d.checkStatus(e.key).isAll?(i[0].checked||(i.prop("checked",!0),e.renderForm("checkbox")),a(!0)):(i[0].checked&&(i.prop("checked",!1),e.renderForm("checkbox")),a(!1)))},I.prototype.getCssRule=function(e,t){var i=this,a=i.elem.find("style")[0],l=a.sheet||a.styleSheet||{},n=l.cssRules||l.rules;layui.each(n,function(i,a){if(a.selectorText===".laytable-cell-"+e)return t(a),!0})},I.prototype.fullSize=function(){var e,t=this,i=t.config,a=i.height;t.fullHeightGap&&(a=j.height()-t.fullHeightGap,a<135&&(a=135),t.elem.css("height",a)),a&&(e=parseFloat(a)-(t.layHeader.outerHeight()||38),i.toolbar&&(e-=t.layTool.outerHeight()||50),i.totalRow&&(e-=t.layTotal.outerHeight()||40),i.page&&(e-=t.layPage.outerHeight()||41),t.layMain.css("height",e-2))},I.prototype.getScrollWidth=function(e){var t=0;return e?t=e.offsetWidth-e.clientWidth:(e=document.createElement("div"),e.style.width="100px",e.style.height="100px",e.style.overflowY="scroll",document.body.appendChild(e),t=e.offsetWidth-e.clientWidth,document.body.removeChild(e)),t},I.prototype.scrollPatch=function(){var e=this,i=e.layMain.children("table"),a=e.layMain.width()-e.layMain.prop("clientWidth"),l=e.layMain.height()-e.layMain.prop("clientHeight"),n=(e.getScrollWidth(e.layMain[0]),i.outerWidth()-e.layMain.width()),o=function(e){if(a&&l){if(e=e.eq(0),!e.find(".layui-table-patch")[0]){var i=t('
导出到 Csv 文件 ','导出到 Excel 文件 '].join("")}(),done:function(e,l){l.on("click",function(){var e=t(this).data("type");d.exportFile.call(i,a.id,null,e)})}});break;case"LAYTABLE_PRINT":var u=window.open("打印窗口","_blank"),h=[""].join(""),v=t(i.layHeader.html());v.append(i.layMain.find("table").html()),v.append(i.layTotal.find("table").html()),v.find("th.layui-table-patch").remove(),v.find(".layui-table-col-special").remove(),u.document.write(h+v.prop("outerHTML")),u.document.close(),u.print(),u.close()}layui.event.call(this,y,"toolbar("+p+")",t.extend({event:c,config:a},{}))}),s.on("mousemove",function(e){var i=t(this),a=i.offset().left,l=e.clientX-a;i.data("unresize")||c.resizeStart||(c.allowResize=i.width()-l<=10,o.css("cursor",c.allowResize?"col-resize":""))}).on("mouseleave",function(){t(this);c.resizeStart||o.css("cursor","")}).on("mousedown",function(e){var l=t(this);if(c.allowResize){var n=l.data("key");e.preventDefault(),c.resizeStart=!0,c.offset=[e.clientX,e.clientY],i.getCssRule(n,function(e){var t=e.style.width||l.outerWidth();c.rule=e,c.ruleWidth=parseFloat(t),c.minWidth=l.data("minwidth")||a.cellMinWidth})}}),F.on("mousemove",function(t){if(c.resizeStart){if(t.preventDefault(),c.rule){var a=c.ruleWidth+t.clientX-c.offset[0];a');return n[0].value=i.data("content")||l.text(),i.find("."+R)[0]||i.append(n),n.focus(),void layui.stope(e)}}).on("mouseenter","td",function(){b.call(this)}).on("mouseleave","td",function(){b.call(this,"hide")});var g="layui-table-grid-down",b=function(e){var i=t(this),a=i.children(h);if(!i.data("off"))if(e)i.find(".layui-table-grid-down").remove();else if(a.prop("scrollWidth")>a.outerWidth()){if(a.find("."+g)[0])return;i.append('
')}};i.layBody.on("click","."+g,function(e){var n=t(this),o=n.parent(),d=o.children(h);i.tipsIndex=l.tips(['',d.html(),"
",''+("updown"===n.anim?"":"")+" ",''+("updown"===n.anim?"":"")+" "].join(""));n.elem.attr("lay-arrow",n.arrow),n.elem.find("."+u)[0]&&n.elem.find("."+u).remove(),n.elem.append(t),t.on("click",function(){var n=i(this),t=n.attr("lay-type");e.slide(t)})},m.prototype.indicator=function(){var e=this,n=e.config,t=e.elemInd=i(['',function(){var i=[];return layui.each(e.elemItem,function(e){i.push("")}),i.join("")}()," l.length&&(l.value=l.length),parseInt(l.value)!==l.value&&(l.half||(l.value=Math.ceil(l.value)-l.value<.5?Math.ceil(l.value):Math.floor(l.value)));for(var n='",s=1;s<=l.length;s++){var r=' "+(l.text?''+l.value+"星":"")+" ";var c=l.elem,f=c.next("."+t);f[0]&&f.remove(),e.elemTemp=a(n),l.span=e.elemTemp.next("span"),l.setText&&l.setText(l.value),c.html(e.elemTemp),c.addClass("layui-inline"),l.readonly||e.action()},v.prototype.setvalue=function(e){var a=this,l=a.config;l.value=e,a.render()},v.prototype.action=function(){var e=this,l=e.config,i=e.elemTemp,n=i.find("i").width();i.children("li").each(function(e){var t=e+1,v=a(this);v.on("click",function(e){if(l.value=t,l.half){var o=e.pageX-a(this).offset().left;o<=n/2&&(l.value=l.value-.5)}l.text&&i.next("span").text(l.value+"星"),l.choose&&l.choose(l.value),l.setText&&l.setText(l.value)}),v.on("mousemove",function(e){if(i.find("i").each(function(){a(this).addClass(o).removeClass(r)}),i.find("i:lt("+t+")").each(function(){a(this).addClass(u).removeClass(f)}),l.half){var c=e.pageX-a(this).offset().left;c<=n/2&&v.children("i").addClass(s).removeClass(u)}}),v.on("mouseleave",function(){i.find("i").each(function(){a(this).addClass(o).removeClass(r)}),i.find("i:lt("+Math.floor(l.value)+")").each(function(){a(this).addClass(u).removeClass(f)}),l.half&&parseInt(l.value)!==l.value&&i.children("li:eq("+Math.floor(l.value)+")").children("i").addClass(s).removeClass(c)})})},v.prototype.events=function(){var e=this;e.config},l.render=function(e){var a=new v(e);return i.call(a)},e(n,l)});layui.define("jquery",function(e){"use strict";var l=layui.$,o=function(e){},t=' ';o.prototype.load=function(e){var o,i,n,r,a=this,c=0;e=e||{};var f=l(e.elem);if(f[0]){var m=l(e.scrollElem||document),u=e.mb||50,s=!("isAuto"in e)||e.isAuto,v=e.end||"没有更多了",y=e.scrollElem&&e.scrollElem!==document,d="加载更多 ",h=l('");f.find(".layui-flow-more")[0]||f.append(h);var p=function(e,t){e=l(e),h.before(e),t=0==t||null,t?h.html(v):h.find("a").html(d),i=t,o=null,n&&n()},g=function(){o=!0,h.find("a").html(t),"function"==typeof e.done&&e.done(++c,p)};if(g(),h.find("a").on("click",function(){l(this);i||o||g()}),e.isLazyimg)var n=a.lazyimg({elem:e.elem+" img",scrollElem:e.scrollElem});return s?(m.on("scroll",function(){var e=l(this),t=e.scrollTop();r&&clearTimeout(r),!i&&f.width()&&(r=setTimeout(function(){var i=y?e.height():l(window).height(),n=y?e.prop("scrollHeight"):document.documentElement.scrollHeight;n-t-i<=u&&(o||g())},100))}),a):a}},o.prototype.lazyimg=function(e){var o,t=this,i=0;e=e||{};var n=l(e.scrollElem||document),r=e.elem||"img",a=e.scrollElem&&e.scrollElem!==document,c=function(e,l){var o=n.scrollTop(),r=o+l,c=a?function(){return e.offset().top-n.offset().top+o}():e.offset().top;if(c>=o&&c<=r&&!e.attr("src")){var m=e.attr("lay-src");layui.img(m,function(){var l=t.lazyimg.elem.eq(i);e.attr("src",m).removeAttr("lay-src"),l[0]&&f(l),i++})}},f=function(e,o){var f=a?(o||n).height():l(window).height(),m=n.scrollTop(),u=m+f;if(t.lazyimg.elem=l(r),e)c(e,f);else for(var s=0;su)break}};if(f(),!o){var m;n.on("scroll",function(){var e=l(this);m&&clearTimeout(m),m=setTimeout(function(){f(null,e)},50)}),o=!0}return f},e("flow",new o)});layui.define(["layer","form"],function(t){"use strict";var e=layui.$,i=layui.layer,a=layui.form,l=(layui.hint(),layui.device()),n="layedit",o="layui-show",r="layui-disabled",c=function(){var t=this;t.index=0,t.config={tool:["strong","italic","underline","del","|","left","center","right","|","link","unlink","face","image"],hideTool:[],height:280}};c.prototype.set=function(t){var i=this;return e.extend(!0,i.config,t),i},c.prototype.on=function(t,e){return layui.onevent(n,t,e)},c.prototype.build=function(t,i){i=i||{};var a=this,n=a.config,r="layui-layedit",c=e("string"==typeof t?"#"+t:t),u="LAY_layedit_"+ ++a.index,d=c.next("."+r),y=e.extend({},n,i),f=function(){var t=[],e={};return layui.each(y.hideTool,function(t,i){e[i]=!0}),layui.each(y.tool,function(i,a){C[a]&&!e[a]&&t.push(C[a])}),t.join("")}(),m=e(['"].join(""));return l.ie&&l.ie<8?c.removeClass("layui-hide").addClass(o):(d[0]&&d.remove(),s.call(a,m,c[0],y),c.addClass("layui-hide").after(m),a.index)},c.prototype.getContent=function(t){var e=u(t);if(e[0])return d(e[0].document.body.innerHTML)},c.prototype.getText=function(t){var i=u(t);if(i[0])return e(i[0].document.body).text()},c.prototype.setContent=function(t,i,a){var l=u(t);l[0]&&(a?e(l[0].document.body).append(i):e(l[0].document.body).html(i),layedit.sync(t))},c.prototype.sync=function(t){var i=u(t);if(i[0]){var a=e("#"+i[1].attr("textarea"));a.val(d(i[0].document.body.innerHTML))}},c.prototype.getSelection=function(t){var e=u(t);if(e[0]){var i=m(e[0].document);return document.selection?i.text:i.toString()}};var s=function(t,i,a){var l=this,n=t.find("iframe");n.css({height:a.height}).on("load",function(){var o=n.contents(),r=n.prop("contentWindow"),c=o.find("head"),s=e([""].join("")),u=o.find("body");c.append(s),u.attr("contenteditable","true").css({"min-height":a.height}).html(i.value||""),y.apply(l,[r,n,i,a]),g.call(l,r,t,a)})},u=function(t){var i=e("#LAY_layedit_"+t),a=i.prop("contentWindow");return[a,i]},d=function(t){return 8==l.ie&&(t=t.replace(/<.+>/g,function(t){return t.toLowerCase()})),t},y=function(t,a,n,o){var r=t.document,c=e(r.body);c.on("keydown",function(t){var e=t.keyCode;if(13===e){var a=m(r),l=p(a),n=l.parentNode;if("pre"===n.tagName.toLowerCase()){if(t.shiftKey)return;return i.msg("请暂时用shift+enter"),!1}r.execCommand("formatBlock",!1,"")}}),e(n).parents("form").on("submit",function(){var t=c.html();8==l.ie&&(t=t.replace(/<.+>/g,function(t){return t.toLowerCase()})),n.value=t}),c.on("paste",function(e){r.execCommand("formatBlock",!1,"
"),setTimeout(function(){f.call(t,c),n.value=c.html()},100)})},f=function(t){var i=this;i.document;t.find("*[style]").each(function(){var t=this.style.textAlign;this.removeAttribute("style"),e(this).css({"text-align":t||""})}),t.find("table").addClass("layui-table"),t.find("script,link").remove()},m=function(t){return t.selection?t.selection.createRange():t.getSelection().getRangeAt(0)},p=function(t){return t.endContainer||t.parentElement().childNodes[0]},v=function(t,i,a){var l=this.document,n=document.createElement(t);for(var o in i)n.setAttribute(o,i[o]);if(n.removeAttribute("text"),l.selection){var r=a.text||i.text;if("a"===t&&!r)return;r&&(n.innerHTML=r),a.pasteHTML(e(n).prop("outerHTML")),a.select()}else{var r=a.toString()||i.text;if("a"===t&&!r)return;r&&(n.innerHTML=r),a.deleteContents(),a.insertNode(n)}},h=function(t,i){var a=this.document,l="layedit-tool-active",n=p(m(a)),o=function(e){return t.find(".layedit-tool-"+e)};i&&i[i.hasClass(l)?"removeClass":"addClass"](l),t.find(">i").removeClass(l),o("unlink").addClass(r),e(n).parents().each(function(){var t=this.tagName.toLowerCase(),e=this.style.textAlign;"b"!==t&&"strong"!==t||o("b").addClass(l),"i"!==t&&"em"!==t||o("i").addClass(l),"u"===t&&o("u").addClass(l),"strike"===t&&o("d").addClass(l),"p"===t&&("center"===e?o("center").addClass(l):"right"===e?o("right").addClass(l):o("left").addClass(l)),"a"===t&&(o("link").addClass(l),o("unlink").removeClass(r))})},g=function(t,a,l){var n=t.document,o=e(n.body),c={link:function(i){var a=p(i),l=e(a).parent();b.call(o,{href:l.attr("href"),target:l.attr("target")},function(e){var a=l[0];"A"===a.tagName?a.href=e.url:v.call(t,"a",{target:e.target,href:e.url,text:e.url},i)})},unlink:function(t){n.execCommand("unlink")},face:function(e){x.call(this,function(i){v.call(t,"img",{src:i.src,alt:i.alt},e)})},image:function(a){var n=this;layui.use("upload",function(o){var r=l.uploadImage||{};o.render({url:r.url,method:r.type,elem:e(n).find("input")[0],done:function(e){0==e.code?(e.data=e.data||{},v.call(t,"img",{src:e.data.src,alt:e.data.title},a)):i.msg(e.msg||"上传失败")}})})},code:function(e){k.call(o,function(i){v.call(t,"pre",{text:i.code,"lay-lang":i.lang},e)})},help:function(){i.open({type:2,title:"帮助",area:["600px","380px"],shadeClose:!0,shade:.1,skin:"layui-layer-msg",content:["","no"]})}},s=a.find(".layui-layedit-tool"),u=function(){var i=e(this),a=i.attr("layedit-event"),l=i.attr("lay-command");if(!i.hasClass(r)){o.focus();var u=m(n);u.commonAncestorContainer;l?(n.execCommand(l),/justifyLeft|justifyCenter|justifyRight/.test(l)&&n.execCommand("formatBlock",!1,"
"),setTimeout(function(){o.focus()},10)):c[a]&&c[a].call(this,u),h.call(t,s,i)}},d=/image/;s.find(">i").on("mousedown",function(){var t=e(this),i=t.attr("layedit-event");d.test(i)||u.call(this)}).on("click",function(){var t=e(this),i=t.attr("layedit-event");d.test(i)&&u.call(this)}),o.on("click",function(){h.call(t,s),i.close(x.index)})},b=function(t,e){var l=this,n=i.open({type:1,id:"LAY_layedit_link",area:"350px",shade:.05,shadeClose:!0,moveType:1,title:"超链接",skin:"layui-layer-msg",content:['
"].join(""),success:function(t,n){var o="submit(layedit-link-yes)";a.render("radio"),t.find(".layui-btn-primary").on("click",function(){i.close(n),l.focus()}),a.on(o,function(t){i.close(b.index),e&&e(t.field)})}});b.index=n},x=function(t){var a=function(){var t=["[微笑]","[嘻嘻]","[哈哈]","[可爱]","[可怜]","[挖鼻]","[吃惊]","[害羞]","[挤眼]","[闭嘴]","[鄙视]","[爱你]","[泪]","[偷笑]","[亲亲]","[生病]","[太开心]","[白眼]","[右哼哼]","[左哼哼]","[嘘]","[衰]","[委屈]","[吐]","[哈欠]","[抱抱]","[怒]","[疑问]","[馋嘴]","[拜拜]","[思考]","[汗]","[困]","[睡]","[钱]","[失望]","[酷]","[色]","[哼]","[鼓掌]","[晕]","[悲伤]","[抓狂]","[黑线]","[阴险]","[怒骂]","[互粉]","[心]","[伤心]","[猪头]","[熊猫]","[兔子]","[ok]","[耶]","[good]","[NO]","[赞]","[来]","[弱]","[草泥马]","[神马]","[囧]","[浮云]","[给力]","[围观]","[威武]","[奥特曼]","[礼物]","[钟]","[话筒]","[蜡烛]","[蛋糕]"],e={};return layui.each(t,function(t,i){e[i]=layui.cache.dir+"images/face/"+t+".gif"}),e}();return x.hide=x.hide||function(t){"face"!==e(t.target).attr("layedit-event")&&i.close(x.index)},x.index=i.tips(function(){var t=[];return layui.each(a,function(e,i){t.push(' ',italic:' ',underline:' ',del:' ',"|":' ',center:' ',right:' ',link:' ',unlink:' ',face:' ',image:' ',code:' ',help:' '},L=new c;t(n,L)});layui.define("jquery",function(a){"use strict";var e=layui.$;a("code",function(a){var l=[];a=a||{},a.elem=e(a.elem||".layui-code"),a.lang="lang"in a?a.lang:"code",a.elem.each(function(){l.push(this)}),layui.each(l.reverse(),function(l,i){var t=e(i),c=t.html();(t.attr("lay-encode")||a.encode)&&(c=c.replace(/&(?!#?[a-zA-Z0-9]+;)/g,"&").replace(//g,">").replace(/'/g,"'").replace(/"/g,""")),t.html(''+c.replace(/[\r\t\n]+/g," ")+" 
+ 
+ 
+ 
+ 
+ 
+
JavaSecLab 一款综合Java漏洞平台)
-# JavaSecLab 一款综合Java漏洞平台
+#  JavaSecLab - A Comprehensive Java Vulnerability Lab
+
+
-
-
-
+
-初始账号密码：admin/admin(后台可修改)
+### Docker Deployment
-### Docker部署(推荐)
+Requirements:
-> 条件：已安装docker和docker-compose
->
-> docker部署过程中 sql文件没有初始化执行的话(即数据库为空) 需要手动导入下sql文件
+- Docker
+- Docker Compose
+
+Build and start the lab:
```shell
mvn clean package -DskipTests
docker-compose -p javaseclab up -d
```
-
+If the database is empty after startup, manually import [sql/JavaSecLab.sql](./sql/JavaSecLab.sql).
+
+
+
+
+
+For more deployment options and troubleshooting notes, see the [Deployment Guide](https://github.com/whgojp/JavaSecLab/wiki/%E9%83%A8%E7%BD%B2%E6%8C%87%E5%8D%97).
+
+## Security Notice
+
+JavaSecLab is a vulnerable lab project. It intentionally keeps dangerous endpoints, vulnerable dependencies, and insecure configurations for reproduction and teaching. Run it only locally or in an isolated network.
+
+Recommended precautions:
+
+- Do not deploy JavaSecLab directly on a public network.
+- Use disposable accounts, test databases, and isolated containers.
+- Do not mount sensitive host directories into the container.
+- Review exposed ports before running Docker Compose.
+- Treat uploaded files, generated files, and logs as untrusted data.
-
+The secure code examples in this project are for teaching and demonstration. Real business systems usually require authentication, auditing, rate limiting, data validation, dependency governance, monitoring, alerting, and defense in depth.
-## 开源协议
+## Contributing
- **When we speak of free software, we are referring to freedom, not price.**
+Issues and pull requests are welcome. Good contributions include:
-本项目遵循 [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0) 协议，详细的许可证内容请参见项目中的 [LICENSE](./LICENSE) 文件。
+- New vulnerability scenarios with clear vulnerable and fixed code
+- More accurate source/sink notes and code-audit explanations
+- Better vulnerability traffic packets and analysis notes
+- Deployment fixes and documentation improvements
+- UI and interaction improvements that make the lab easier to teach with
-## 一些Tips🙋
+## License
-1. 安全问题：由于是漏洞靶场，因此不建议搭建在公网上使用
-1. 项目中的安全修复代码仅供参考，实际业务中漏洞修复起来可能要复杂的多……
-1. **问题/建议反馈：如果遇到一些项目问题或者更好的建议，欢迎各位师傅可以提Issue或加交流群进行反馈**
-1. **看到这里，师傅觉得项目有用的话，麻烦动动手点个star吧，非常感谢🙏**
+**When we speak of free software, we are referring to freedom, not price.**
-## 关于作者
+JavaSecLab is released under the [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0). See [LICENSE](./LICENSE) for details.
+
+## Changelog
+
+See the [Update Log](https://github.com/whgojp/JavaSecLab/wiki/%E6%9B%B4%E6%96%B0%E6%97%A5%E5%BF%97) for release notes and project history.
+
+## Author
+
+Author's blog: [今天是几号](https://blog.csdn.net/weixin_53009585)
+
+If you are interested in application security, secure development, SDL, DevSecOps, or vulnerability labs, feel free to join the community group.
+
+
+ 
+