md2ui 1.0.19 → 1.0.21

package/vite-plugin-doc-api.js

@@ -24,6 +24,29 @@ export default function docApiPlugin(docsDir = '.') {
     return '"' + crypto.createHash('md5').update(content).digest('hex') + '"'
   }
 
+  // 安全路径验证：使用 path.relative 防止路径遍历
+  function safePath(filePath) {
+    const fullPath = path.resolve(resolvedDocsDir, filePath)
+    const relative = path.relative(resolvedDocsDir, fullPath)
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+      return null // 路径越界
+    }
+    return fullPath
+  }
+
+  // 解析 POST 请求的 JSON body
+  function parseJsonBody(req) {
+    return new Promise((resolve, reject) => {
+      let body = ''
+      req.on('data', chunk => { body += chunk })
+      req.on('end', () => {
+        try { resolve(JSON.parse(body)) }
+        catch (e) { reject(e) }
+      })
+      req.on('error', reject)
+    })
+  }
+
   // 递归扫描 .md 文件，返回树结构（与 CLI 模式 scanDocs 一致）
   function scanDocs(dir, basePath = '', level = 0) {
     const items = []
@@ -101,8 +124,8 @@ export default function docApiPlugin(docsDir = '.') {
 
         // GET /@user-docs/xxx — 返回文件内容（md / 图片等）
         if (req.url?.startsWith('/@user-docs/') && req.method === 'GET') {
-          const filePath = path.resolve(resolvedDocsDir, decodeURIComponent(req.url.replace('/@user-docs/', '')))
-          if (!filePath.startsWith(resolvedDocsDir)) {
+          const filePath = safePath(decodeURIComponent(req.url.replace('/@user-docs/', '')))
+          if (!filePath) {
             res.statusCode = 403; res.end('禁止访问'); return
           }
           if (!fs.existsSync(filePath)) {
@@ -144,7 +167,8 @@ export default function docApiPlugin(docsDir = '.') {
               }
 
               const docDir = path.dirname(path.resolve(resolvedDocsDir, docPath))
-              if (!docDir.startsWith(resolvedDocsDir)) {
+              const relative = path.relative(resolvedDocsDir, docDir)
+              if (relative.startsWith('..') || path.isAbsolute(relative)) {
                 res.statusCode = 403; res.end('禁止访问'); return
               }
 
@@ -180,188 +204,165 @@ export default function docApiPlugin(docsDir = '.') {
       })
 
       // POST /api/create — 创建文件或文件夹
-      server.middlewares.use('/api/create', (req, res) => {
+      server.middlewares.use('/api/create', async (req, res) => {
         if (req.method !== 'POST') { res.statusCode = 405; res.end(); return }
-        let body = ''
-        req.on('data', chunk => { body += chunk })
-        req.on('end', () => {
-          try {
-            const { path: filePath, type } = JSON.parse(body)
-            if (!filePath) {
-              res.statusCode = 400; res.end('缺少 path'); return
-            }
-            const fullPath = path.resolve(resolvedDocsDir, filePath)
-            if (!fullPath.startsWith(resolvedDocsDir)) {
-              res.statusCode = 403; res.end('禁止访问'); return
-            }
-            if (fs.existsSync(fullPath)) {
-              res.statusCode = 409; res.end('已存在同名文件或文件夹'); return
-            }
-            if (type === 'folder') {
-              fs.mkdirSync(fullPath, { recursive: true })
-            } else {
-              fs.mkdirSync(path.dirname(fullPath), { recursive: true })
-              fs.writeFileSync(fullPath, '', 'utf-8')
-            }
-            res.setHeader('Content-Type', 'application/json')
-            res.end(JSON.stringify({ ok: true }))
-          } catch (e) {
-            res.statusCode = 500; res.end(e.message)
+        try {
+          const { path: filePath, type } = await parseJsonBody(req)
+          if (!filePath) {
+            res.statusCode = 400; res.end('缺少 path'); return
           }
-        })
+          const fullPath = safePath(filePath)
+          if (!fullPath) {
+            res.statusCode = 403; res.end('禁止访问'); return
+          }
+          if (fs.existsSync(fullPath)) {
+            res.statusCode = 409; res.end('已存在同名文件或文件夹'); return
+          }
+          if (type === 'folder') {
+            fs.mkdirSync(fullPath, { recursive: true })
+          } else {
+            fs.mkdirSync(path.dirname(fullPath), { recursive: true })
+            fs.writeFileSync(fullPath, '', 'utf-8')
+          }
+          res.setHeader('Content-Type', 'application/json')
+          res.end(JSON.stringify({ ok: true }))
+        } catch (e) {
+          res.statusCode = 500; res.end(e.message)
+        }
       })
 
       // POST /api/delete — 删除文件或文件夹
-      server.middlewares.use('/api/delete', (req, res) => {
+      server.middlewares.use('/api/delete', async (req, res) => {
         if (req.method !== 'POST') { res.statusCode = 405; res.end(); return }
-        let body = ''
-        req.on('data', chunk => { body += chunk })
-        req.on('end', () => {
-          try {
-            const { path: filePath } = JSON.parse(body)
-            if (!filePath) {
-              res.statusCode = 400; res.end('缺少 path'); return
-            }
-            const fullPath = path.resolve(resolvedDocsDir, filePath)
-            if (!fullPath.startsWith(resolvedDocsDir)) {
-              res.statusCode = 403; res.end('禁止访问'); return
-            }
-            if (!fs.existsSync(fullPath)) {
-              res.statusCode = 404; res.end('文件不存在'); return
-            }
-            fs.rmSync(fullPath, { recursive: true, force: true })
-            res.setHeader('Content-Type', 'application/json')
-            res.end(JSON.stringify({ ok: true }))
-          } catch (e) {
-            res.statusCode = 500; res.end(e.message)
+        try {
+          const { path: filePath } = await parseJsonBody(req)
+          if (!filePath) {
+            res.statusCode = 400; res.end('缺少 path'); return
           }
-        })
+          const fullPath = safePath(filePath)
+          if (!fullPath) {
+            res.statusCode = 403; res.end('禁止访问'); return
+          }
+          if (!fs.existsSync(fullPath)) {
+            res.statusCode = 404; res.end('文件不存在'); return
+          }
+          fs.rmSync(fullPath, { recursive: true, force: true })
+          res.setHeader('Content-Type', 'application/json')
+          res.end(JSON.stringify({ ok: true }))
+        } catch (e) {
+          res.statusCode = 500; res.end(e.message)
+        }
       })
 
       // POST /api/rename — 重命名文件或文件夹
-      server.middlewares.use('/api/rename', (req, res) => {
+      server.middlewares.use('/api/rename', async (req, res) => {
         if (req.method !== 'POST') { res.statusCode = 405; res.end(); return }
-        let body = ''
-        req.on('data', chunk => { body += chunk })
-        req.on('end', () => {
-          try {
-            const { oldPath, newPath } = JSON.parse(body)
-            if (!oldPath || !newPath) {
-              res.statusCode = 400; res.end('缺少 oldPath 或 newPath'); return
-            }
-            const fullOld = path.resolve(resolvedDocsDir, oldPath)
-            const fullNew = path.resolve(resolvedDocsDir, newPath)
-            if (!fullOld.startsWith(resolvedDocsDir) || !fullNew.startsWith(resolvedDocsDir)) {
-              res.statusCode = 403; res.end('禁止访问'); return
-            }
-            if (!fs.existsSync(fullOld)) {
-              res.statusCode = 404; res.end('源文件不存在'); return
-            }
-            if (fs.existsSync(fullNew)) {
-              res.statusCode = 409; res.end('目标名称已存在'); return
-            }
-            fs.mkdirSync(path.dirname(fullNew), { recursive: true })
-            fs.renameSync(fullOld, fullNew)
-            res.setHeader('Content-Type', 'application/json')
-            res.end(JSON.stringify({ ok: true }))
-          } catch (e) {
-            res.statusCode = 500; res.end(e.message)
+        try {
+          const { oldPath, newPath } = await parseJsonBody(req)
+          if (!oldPath || !newPath) {
+            res.statusCode = 400; res.end('缺少 oldPath 或 newPath'); return
           }
-        })
+          const fullOld = safePath(oldPath)
+          const fullNew = safePath(newPath)
+          if (!fullOld || !fullNew) {
+            res.statusCode = 403; res.end('禁止访问'); return
+          }
+          if (!fs.existsSync(fullOld)) {
+            res.statusCode = 404; res.end('源文件不存在'); return
+          }
+          if (fs.existsSync(fullNew)) {
+            res.statusCode = 409; res.end('目标名称已存在'); return
+          }
+          fs.mkdirSync(path.dirname(fullNew), { recursive: true })
+          fs.renameSync(fullOld, fullNew)
+          res.setHeader('Content-Type', 'application/json')
+          res.end(JSON.stringify({ ok: true }))
+        } catch (e) {
+          res.statusCode = 500; res.end(e.message)
+        }
       })
 
       // POST /api/reorder — 批量重编号
-      server.middlewares.use('/api/reorder', (req, res) => {
+      server.middlewares.use('/api/reorder', async (req, res) => {
         if (req.method !== 'POST') { res.statusCode = 405; res.end(); return }
-        let body = ''
-        req.on('data', chunk => { body += chunk })
-        req.on('end', () => {
-          try {
-            const { items } = JSON.parse(body)
-            if (!Array.isArray(items) || items.length === 0) {
-              res.statusCode = 400; res.end('缺少 items'); return
-            }
-            for (const { oldPath, newPath } of items) {
-              const fullOld = path.resolve(resolvedDocsDir, oldPath)
-              const fullNew = path.resolve(resolvedDocsDir, newPath)
-              if (!fullOld.startsWith(resolvedDocsDir) || !fullNew.startsWith(resolvedDocsDir)) {
-                res.statusCode = 403; res.end('禁止访问'); return
-              }
-            }
-            const tempMap = []
-            for (let i = 0; i < items.length; i++) {
-              const { oldPath } = items[i]
-              const fullOld = path.resolve(resolvedDocsDir, oldPath)
-              if (!fs.existsSync(fullOld)) continue
-              const tempName = fullOld + `.__reorder_tmp_${i}__`
-              fs.renameSync(fullOld, tempName)
-              tempMap.push({ temp: tempName, newPath: items[i].newPath })
-            }
-            for (const { temp, newPath: np } of tempMap) {
-              const fullNew = path.resolve(resolvedDocsDir, np)
-              fs.mkdirSync(path.dirname(fullNew), { recursive: true })
-              fs.renameSync(temp, fullNew)
+        try {
+          const { items } = await parseJsonBody(req)
+          if (!Array.isArray(items) || items.length === 0) {
+            res.statusCode = 400; res.end('缺少 items'); return
+          }
+          // 验证所有路径
+          for (const { oldPath, newPath } of items) {
+            if (!safePath(oldPath) || !safePath(newPath)) {
+              res.statusCode = 403; res.end('禁止访问'); return
             }
-            res.setHeader('Content-Type', 'application/json')
-            res.end(JSON.stringify({ ok: true }))
-          } catch (e) {
-            res.statusCode = 500; res.end(e.message)
           }
-        })
+          // 先全部重命名为临时文件，再重命名为目标文件（避免冲突）
+          const tempMap = []
+          for (let i = 0; i < items.length; i++) {
+            const { oldPath } = items[i]
+            const fullOld = safePath(oldPath)
+            if (!fullOld || !fs.existsSync(fullOld)) continue
+            const tempName = fullOld + `.__reorder_tmp_${i}__`
+            fs.renameSync(fullOld, tempName)
+            tempMap.push({ temp: tempName, newPath: items[i].newPath })
+          }
+          for (const { temp, newPath: np } of tempMap) {
+            const fullNew = safePath(np)
+            if (!fullNew) continue
+            fs.mkdirSync(path.dirname(fullNew), { recursive: true })
+            fs.renameSync(temp, fullNew)
+          }
+          res.setHeader('Content-Type', 'application/json')
+          res.end(JSON.stringify({ ok: true }))
+        } catch (e) {
+          res.statusCode = 500; res.end(e.message)
+        }
       })
 
       // POST /api/move — 移动文件/文件夹
-      server.middlewares.use('/api/move', (req, res) => {
+      server.middlewares.use('/api/move', async (req, res) => {
         if (req.method !== 'POST') { res.statusCode = 405; res.end(); return }
-        let body = ''
-        req.on('data', chunk => { body += chunk })
-        req.on('end', () => {
-          try {
-            const { oldPath, newPath } = JSON.parse(body)
-            if (!oldPath || !newPath) {
-              res.statusCode = 400; res.end('缺少 oldPath 或 newPath'); return
-            }
-            const fullOld = path.resolve(resolvedDocsDir, oldPath)
-            const fullNew = path.resolve(resolvedDocsDir, newPath)
-            if (!fullOld.startsWith(resolvedDocsDir) || !fullNew.startsWith(resolvedDocsDir)) {
-              res.statusCode = 403; res.end('禁止访问'); return
-            }
-            if (!fs.existsSync(fullOld)) {
-              res.statusCode = 404; res.end('源文件不存在'); return
-            }
-            fs.mkdirSync(path.dirname(fullNew), { recursive: true })
-            fs.renameSync(fullOld, fullNew)
-            res.setHeader('Content-Type', 'application/json')
-            res.end(JSON.stringify({ ok: true }))
-          } catch (e) {
-            res.statusCode = 500; res.end(e.message)
+        try {
+          const { oldPath, newPath } = await parseJsonBody(req)
+          if (!oldPath || !newPath) {
+            res.statusCode = 400; res.end('缺少 oldPath 或 newPath'); return
           }
-        })
+          const fullOld = safePath(oldPath)
+          const fullNew = safePath(newPath)
+          if (!fullOld || !fullNew) {
+            res.statusCode = 403; res.end('禁止访问'); return
+          }
+          if (!fs.existsSync(fullOld)) {
+            res.statusCode = 404; res.end('源文件不存在'); return
+          }
+          fs.mkdirSync(path.dirname(fullNew), { recursive: true })
+          fs.renameSync(fullOld, fullNew)
+          res.setHeader('Content-Type', 'application/json')
+          res.end(JSON.stringify({ ok: true }))
+        } catch (e) {
+          res.statusCode = 500; res.end(e.message)
+        }
       })
 
       // POST /api/save — 保存文件内容
-      server.middlewares.use('/api/save', (req, res) => {
+      server.middlewares.use('/api/save', async (req, res) => {
         if (req.method !== 'POST') { res.statusCode = 405; res.end(); return }
-        let body = ''
-        req.on('data', chunk => { body += chunk })
-        req.on('end', () => {
-          try {
-            const { path: filePath, content } = JSON.parse(body)
-            if (!filePath || content == null) {
-              res.statusCode = 400; res.end('缺少 path 或 content'); return
-            }
-            const fullPath = path.resolve(resolvedDocsDir, filePath)
-            if (!fullPath.startsWith(resolvedDocsDir)) {
-              res.statusCode = 403; res.end('禁止访问'); return
-            }
-            fs.mkdirSync(path.dirname(fullPath), { recursive: true })
-            fs.writeFileSync(fullPath, content, 'utf-8')
-            res.setHeader('Content-Type', 'application/json')
-            res.end(JSON.stringify({ ok: true }))
-          } catch (e) {
-            res.statusCode = 500; res.end(e.message)
+        try {
+          const { path: filePath, content } = await parseJsonBody(req)
+          if (!filePath || content == null) {
+            res.statusCode = 400; res.end('缺少 path 或 content'); return
           }
-        })
+          const fullPath = safePath(filePath)
+          if (!fullPath) {
+            res.statusCode = 403; res.end('禁止访问'); return
+          }
+          fs.mkdirSync(path.dirname(fullPath), { recursive: true })
+          fs.writeFileSync(fullPath, content, 'utf-8')
+          res.setHeader('Content-Type', 'application/json')
+          res.end(JSON.stringify({ ok: true }))
+        } catch (e) {
+          res.statusCode = 500; res.end(e.message)
+        }
       })
     }
   }

package/vite.config.js

@@ -9,6 +9,10 @@ export default defineConfig({
     port: config.defaultPort
   },
   optimizeDeps: {
-    include: ['vue', 'marked', 'mermaid']
+    include: [
+      'vue',
+      'marked',
+      'mermaid',
+    ],
   }
 })

package/src/components/SearchPanel.vue

@@ -1,90 +0,0 @@
-<template>
-  <teleport to="body">
-    <div v-if="visible" class="search-overlay" @click.self="$emit('close')">
-      <div class="search-panel">
-        <div class="search-input-wrapper">
-          <Search :size="18" class="search-icon" />
-          <input
-            ref="inputRef"
-            type="text"
-            class="search-input"
-            placeholder="搜索文档..."
-            :value="query"
-            @input="$emit('search', $event.target.value)"
-            @keydown.escape="$emit('close')"
-            @keydown.enter="handleEnter"
-            @keydown.up.prevent="moveSelection(-1)"
-            @keydown.down.prevent="moveSelection(1)"
-          />
-          <kbd class="search-kbd">ESC</kbd>
-        </div>
-        <div class="search-results" v-if="query">
-          <div v-if="results.length === 0" class="search-empty">
-            没有找到相关文档
-          </div>
-          <div
-            v-for="(item, index) in results"
-            :key="item.key"
-            :class="['search-result-item', { active: index === selectedIndex }]"
-            @click="selectResult(item)"
-            @mouseenter="selectedIndex = index"
-          >
-            <FileText :size="16" class="result-icon" />
-            <span class="result-title">{{ item.title }}</span>
-          </div>
-        </div>
-        <div class="search-footer" v-if="!query">
-          <span class="search-tip">输入关键词搜索文档内容</span>
-        </div>
-      </div>
-    </div>
-  </teleport>
-</template>
-
-<script setup>
-import { ref, watch, nextTick } from 'vue'
-import { Search, FileText } from 'lucide-vue-next'
-
-const props = defineProps({
-  visible: { type: Boolean, default: false },
-  query: { type: String, default: '' },
-  results: { type: Array, default: () => [] }
-})
-
-const emit = defineEmits(['close', 'search', 'select'])
-const inputRef = ref(null)
-const selectedIndex = ref(0)
-
-// 面板打开时自动聚焦输入框
-watch(() => props.visible, (val) => {
-  if (val) {
-    selectedIndex.value = 0
-    nextTick(() => inputRef.value?.focus())
-  }
-})
-
-// 搜索结果变化时重置选中
-watch(() => props.results, () => {
-  selectedIndex.value = 0
-})
-
-// 键盘上下移动选中项
-function moveSelection(delta) {
-  const len = props.results.length
-  if (len === 0) return
-  selectedIndex.value = (selectedIndex.value + delta + len) % len
-}
-
-// 回车选中
-function handleEnter() {
-  if (props.results.length > 0) {
-    selectResult(props.results[selectedIndex.value])
-  }
-}
-
-// 选中结果
-function selectResult(item) {
-  emit('select', item.key)
-  emit('close')
-}
-</script>

package/src/components/TableBubbleMenu.vue

@@ -1,177 +0,0 @@
-<template>
-  <teleport to="body">
-    <div
-      v-if="show"
-      ref="menuRef"
-      class="table-bubble-menu"
-      :style="menuStyle"
-    >
-      <div class="table-bubble-group">
-        <button class="table-bubble-btn" @click="addColumnBefore" title="在左侧插入列">
-          <BetweenVerticalStart :size="14" />
-        </button>
-        <button class="table-bubble-btn" @click="addColumnAfter" title="在右侧插入列">
-          <BetweenVerticalEnd :size="14" />
-        </button>
-        <button class="table-bubble-btn danger" @click="deleteColumn" title="删除当前列">
-          <Columns3 :size="14" />
-          <X :size="10" class="table-bubble-badge" />
-        </button>
-      </div>
-      <div class="table-bubble-divider"></div>
-      <div class="table-bubble-group">
-        <button class="table-bubble-btn" @click="addRowBefore" title="在上方插入行">
-          <BetweenHorizontalStart :size="14" />
-        </button>
-        <button class="table-bubble-btn" @click="addRowAfter" title="在下方插入行">
-          <BetweenHorizontalEnd :size="14" />
-        </button>
-        <button class="table-bubble-btn danger" @click="deleteRow" title="删除当前行">
-          <RowsIcon :size="14" />
-          <X :size="10" class="table-bubble-badge" />
-        </button>
-      </div>
-      <div class="table-bubble-divider"></div>
-      <div class="table-bubble-group">
-        <button class="table-bubble-btn" @click="mergeCells" title="合并单元格">
-          <TableCellsMerge :size="14" />
-        </button>
-        <button class="table-bubble-btn" @click="splitCell" title="拆分单元格">
-          <TableCellsSplit :size="14" />
-        </button>
-      </div>
-      <div class="table-bubble-divider"></div>
-      <button class="table-bubble-btn danger" @click="deleteTable" title="删除表格">
-        <Trash2 :size="14" />
-      </button>
-    </div>
-  </teleport>
-</template>
-
-<script setup>
-import { computed, ref, watch, onMounted, onUnmounted, nextTick } from 'vue'
-import {
-  BetweenVerticalStart, BetweenVerticalEnd, Columns3,
-  BetweenHorizontalStart, BetweenHorizontalEnd, Rows3 as RowsIcon,
-  TableCellsMerge, TableCellsSplit,
-  Trash2, X,
-} from 'lucide-vue-next'
-
-const props = defineProps({
-  editor: { type: Object, required: true }
-})
-
-const menuRef = ref(null)
-const menuStyle = ref({})
-
-const show = computed(() => {
-  if (!props.editor) return false
-  if (props.editor.isActive('codeBlock') || props.editor.isActive('mermaidBlock')) return false
-  return props.editor.isActive('table')
-})
-
-// 计算菜单位置：定位到表格上方
-function updatePosition() {
-  if (!show.value || !props.editor) return
-
-  const { view } = props.editor
-  const { state } = view
-
-  // 找到当前所在的 table 节点
-  let tablePos = null
-  const { $from } = state.selection
-  for (let d = $from.depth; d > 0; d--) {
-    if ($from.node(d).type.name === 'table') {
-      tablePos = $from.start(d) - 1
-      break
-    }
-  }
-  if (tablePos === null) return
-
-  // 获取表格 DOM 元素的位置
-  const dom = view.nodeDOM(tablePos)
-  if (!dom) return
-
-  const tableRect = dom.getBoundingClientRect()
-  const menuEl = menuRef.value
-  if (!menuEl) return
-
-  const menuWidth = menuEl.offsetWidth
-  // 水平居中于表格上方
-  let left = tableRect.left + (tableRect.width - menuWidth) / 2
-  let top = tableRect.top - menuEl.offsetHeight - 8
-
-  // 边界修正
-  if (left < 8) left = 8
-  if (left + menuWidth > window.innerWidth - 8) left = window.innerWidth - menuWidth - 8
-  if (top < 8) top = tableRect.bottom + 8 // 表格上方放不下就放下方
-
-  menuStyle.value = {
-    position: 'fixed',
-    left: `${left}px`,
-    top: `${top}px`,
-    zIndex: 100,
-  }
-}
-
-// 监听 show 变化和编辑器事务来更新位置
-watch(show, async (val) => {
-  if (val) {
-    await nextTick()
-    updatePosition()
-  }
-})
-
-let updateTimer = null
-function onTransaction() {
-  if (!show.value) return
-  if (updateTimer) cancelAnimationFrame(updateTimer)
-  updateTimer = requestAnimationFrame(updatePosition)
-}
-
-onMounted(() => {
-  if (props.editor) {
-    props.editor.on('transaction', onTransaction)
-    // 滚动时也更新位置
-    const scrollEl = document.querySelector('.editor-content')
-    if (scrollEl) scrollEl.addEventListener('scroll', updatePosition, { passive: true })
-  }
-})
-
-onUnmounted(() => {
-  if (props.editor) {
-    props.editor.off('transaction', onTransaction)
-  }
-  const scrollEl = document.querySelector('.editor-content')
-  if (scrollEl) scrollEl.removeEventListener('scroll', updatePosition)
-  if (updateTimer) cancelAnimationFrame(updateTimer)
-})
-
-function addColumnBefore() {
-  props.editor.chain().focus().addColumnBefore().run()
-}
-function addColumnAfter() {
-  props.editor.chain().focus().addColumnAfter().run()
-}
-function deleteColumn() {
-  props.editor.chain().focus().deleteColumn().run()
-}
-function addRowBefore() {
-  props.editor.chain().focus().addRowBefore().run()
-}
-function addRowAfter() {
-  props.editor.chain().focus().addRowAfter().run()
-}
-function deleteRow() {
-  props.editor.chain().focus().deleteRow().run()
-}
-function mergeCells() {
-  props.editor.chain().focus().mergeCells().run()
-}
-function splitCell() {
-  props.editor.chain().focus().splitCell().run()
-}
-function deleteTable() {
-  props.editor.chain().focus().deleteTable().run()
-}
-</script>