diff --git a/o2web/source/o2_core/o2/xAction/services/x_attendance_assemble_control.js b/o2web/source/o2_core/o2/xAction/services/x_attendance_assemble_control.js
index 3f4c30bd21bf83228cba93067bbe5267585921a5..5bccb512785f3144c4e34e0c6fdb05bcd751b7bc 100644
--- a/o2web/source/o2_core/o2/xAction/services/x_attendance_assemble_control.js
+++ b/o2web/source/o2_core/o2/xAction/services/x_attendance_assemble_control.js
@@ -13,7 +13,7 @@ MWF.xAction.RestActions.Action["x_attendance_assemble_control"] = new Class({
             var url = this.action.actions.exportSelfHoliday.uri;
             url = url.replace("{startdate}", startdate);
             url = url.replace("{enddate}", enddate);
-            window.open(this.action.address+url , "_blank");
+            window.open(o2.filterUrl(this.action.address+url , "_blank"));
         }.bind(this));
     },
     uploadAttachment: function(success, failure, formData, file){
@@ -23,7 +23,7 @@ MWF.xAction.RestActions.Action["x_attendance_assemble_control"] = new Class({
         this.action.getActions(function(){
             var url = this.action.actions.getAttachmentStream.uri;
             url = url.replace("{id}", encodeURIComponent(id));
-            window.open(this.action.address+url);
+            window.open(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
     exportAbnormalAttachment: function(year, month, success, failure){
@@ -31,7 +31,7 @@ MWF.xAction.RestActions.Action["x_attendance_assemble_control"] = new Class({
             var url = this.action.actions.exportAbnormalAttachment.uri;
             url = url.replace("{year}", year);
             url = url.replace("{month}", month);
-            window.open(this.action.address+url , "_blank");
+            window.open(o2.filterUrl(this.action.address+url , "_blank"));
         }.bind(this));
         //this.action.invoke({"name": "exportAbnormalAttachment", "parameter": {"year": year, "month": month },"success": success,"failure": failure});
     },
diff --git a/o2web/source/o2_core/o2/xAction/services/x_bbs_assemble_control.js b/o2web/source/o2_core/o2/xAction/services/x_bbs_assemble_control.js
index 03c5ec4322e8af584b987f1c62edec1af05ce7f5..3c461d01512bde49059454d7803b00ae05820c56 100644
--- a/o2web/source/o2_core/o2/xAction/services/x_bbs_assemble_control.js
+++ b/o2web/source/o2_core/o2/xAction/services/x_bbs_assemble_control.js
@@ -25,7 +25,7 @@ MWF.xAction.RestActions.Action["x_bbs_assemble_control"] = new Class({
             var url = this.action.actions.getAttachmentData.uri;
             url = url.replace("{id}", encodeURIComponent(id));
             url = url.replace("{documentid}", encodeURIComponent(documentid));
-            window.open(this.action.address+url);
+            window.open(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
     getAttachmentStream: function(id, documentid){
@@ -33,7 +33,7 @@ MWF.xAction.RestActions.Action["x_bbs_assemble_control"] = new Class({
             var url = this.action.actions.getAttachmentStream.uri;
             url = url.replace("{id}", encodeURIComponent(id));
             url = url.replace("{documentid}", encodeURIComponent(documentid));
-            window.open(this.action.address+url);
+            window.open(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
 
@@ -42,7 +42,7 @@ MWF.xAction.RestActions.Action["x_bbs_assemble_control"] = new Class({
             var url = this.action.actions.getAttachmentData.uri;
             url = url.replace("{id}", encodeURIComponent(id));
             url = url.replace("{documentid}", encodeURIComponent(documentid));
-            if (callback) callback(this.action.address+url);
+            if (callback) callback(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
     convertLocalImageToBase64: function(size, success, failure, formData, file){
diff --git a/o2web/source/o2_core/o2/xAction/services/x_file_assemble_control.js b/o2web/source/o2_core/o2/xAction/services/x_file_assemble_control.js
index ae15bd4b1f1ac527c94b4a609707df39be1d24e7..ea44e34f286f07989b4548e03de41485a6b84e39 100644
--- a/o2web/source/o2_core/o2/xAction/services/x_file_assemble_control.js
+++ b/o2web/source/o2_core/o2/xAction/services/x_file_assemble_control.js
@@ -16,17 +16,16 @@ MWF.xAction.RestActions.Action["x_file_assemble_control"] = new Class({
         this.action.getActions(function(){
             var url = this.action.actions.getAttachmentStream.uri;
             url = url.replace("{id}", encodeURIComponent(id));
-            if (callback) callback(this.action.address+url);
+            if (callback) callback(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
     getFileDownloadUrl: function(id, callback){
         this.action.getActions(function(){
             var url = this.action.actions.getAttachmentData.uri;
             url = url.replace("{id}", encodeURIComponent(id));
-            if (callback) callback(this.action.address+url);
+            if (callback) callback(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
-
     getBase64Code: function(success, failure, id, width, height, async){
         width = width || 0;
         height = height ||0;
diff --git a/o2web/source/o2_core/o2/xAction/services/x_meeting_assemble_control.js b/o2web/source/o2_core/o2/xAction/services/x_meeting_assemble_control.js
index 0fd6577e3cdec0b8ae433be2cabb4a93ca4207aa..081e808ad18da2e4f9608cc6c5e01814eed4c258 100644
--- a/o2web/source/o2_core/o2/xAction/services/x_meeting_assemble_control.js
+++ b/o2web/source/o2_core/o2/xAction/services/x_meeting_assemble_control.js
@@ -33,28 +33,28 @@ MWF.xAction.RestActions.Action["x_meeting_assemble_control"] = new Class({
         this.action.getActions(function(){
             var url = this.action.actions.getAttachmentData.uri;
             url = url.replace("{id}", encodeURIComponent(id));
-            if (callback) callback(this.action.address+url);
+            if (callback) callback(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
     getFileDownloadUrl: function(id, callback){
         this.action.getActions(function(){
             var url = this.action.actions.getAttachmentStream.uri;
             url = url.replace("{id}", encodeURIComponent(id));
-            if (callback) callback(this.action.address+url);
+            if (callback) callback(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
     getFile: function(id, callback){
         this.action.getActions(function(){
             var url = this.action.actions.getAttachmentData.uri;
             url = url.replace("{id}", encodeURIComponent(id));
-            window.open(this.action.address+url);
+            window.open(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
     getFileDownload: function(id, callback){
         this.action.getActions(function(){
             var url = this.action.actions.getAttachmentStream.uri;
             url = url.replace("{id}", encodeURIComponent(id));
-            window.open(this.action.address+url);
+            window.open(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
 
diff --git a/o2web/source/o2_core/o2/xAction/services/x_okr_assemble_control.js b/o2web/source/o2_core/o2/xAction/services/x_okr_assemble_control.js
index 6fcbd917e495d76338698fc3318f5f2b39a9eed0..f57f4307dcca69baa8bae44a48f650c4d1beff8c 100644
--- a/o2web/source/o2_core/o2/xAction/services/x_okr_assemble_control.js
+++ b/o2web/source/o2_core/o2/xAction/services/x_okr_assemble_control.js
@@ -15,7 +15,7 @@ MWF.xAction.RestActions.Action["x_okr_assemble_control"] = new Class({
             var url = this.action.actions.getAttachmentData.uri;
             url = url.replace("{id}", encodeURIComponent(id));
             url = url.replace("{documentid}", encodeURIComponent(documentid));
-            window.open(this.actionAttachment.address+url);
+            window.open(o2.filterUrl(this.actionAttachment.address+url));
         }.bind(this));
     },
     getAttachmentStream: function(id, documentid){
@@ -23,7 +23,7 @@ MWF.xAction.RestActions.Action["x_okr_assemble_control"] = new Class({
             var url = this.action.actions.getAttachmentStream.uri;
             url = url.replace("{id}", encodeURIComponent(id));
             url = url.replace("{documentid}", encodeURIComponent(documentid));
-            window.open(this.action.address+url);
+            window.open(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
 
@@ -32,7 +32,7 @@ MWF.xAction.RestActions.Action["x_okr_assemble_control"] = new Class({
             var url = this.action.actions.getAttachmentData.uri;
             url = url.replace("{id}", encodeURIComponent(id));
             url = url.replace("{documentid}", encodeURIComponent(documentid));
-            if (callback) callback(this.action.address+url);
+            if (callback) callback(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
 
@@ -44,7 +44,7 @@ MWF.xAction.RestActions.Action["x_okr_assemble_control"] = new Class({
             var url = this.action.actions.getReportAttachmentData.uri;
             url = url.replace("{id}", encodeURIComponent(id));
             url = url.replace("{documentid}", encodeURIComponent(documentid));
-            window.open(this.actionAttachment.address+url);
+            window.open(o2.filterUrl(this.actionAttachment.address+url));
         }.bind(this));
     },
     getReportAttachmentStream: function(id, documentid){
@@ -52,7 +52,7 @@ MWF.xAction.RestActions.Action["x_okr_assemble_control"] = new Class({
             var url = this.action.actions.getReportAttachmentStream.uri;
             url = url.replace("{id}", encodeURIComponent(id));
             url = url.replace("{documentid}", encodeURIComponent(documentid));
-            window.open(this.action.address+url);
+            window.open(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
     deleteReportAttachment: function(id, documentid, success, failure, async){
diff --git a/o2web/source/o2_core/o2/xAction/services/x_processplatform_assemble_surface.js b/o2web/source/o2_core/o2/xAction/services/x_processplatform_assemble_surface.js
index a04b563dc4cd41134b48975712ce14222a53a370..8ac3d8e4f6f1fe17ee935f27c19f6d226f754096 100644
--- a/o2web/source/o2_core/o2/xAction/services/x_processplatform_assemble_surface.js
+++ b/o2web/source/o2_core/o2/xAction/services/x_processplatform_assemble_surface.js
@@ -6,7 +6,7 @@ MWF.xAction.RestActions.Action["x_processplatform_assemble_surface"] = new Class
             var url = this.action.actions["exportViewResult"].uri;
             //url = url.replace("{applicationFlag}", app);
             url = url.replace("{flag}", json.data.id);
-            window.open(this.action.address+url, "_blank");
+            window.open(o2.filterUrl(this.action.address+url, "_blank"));
         }.bind(this)});
     },
     saveDictionary: function(data, success, failure){
diff --git a/o2web/source/o2_core/o2/xAction/services/x_report_assemble_control.js b/o2web/source/o2_core/o2/xAction/services/x_report_assemble_control.js
index 4d8c34d017668b14e44fe23f18283dc4b6648e82..329a553c8d53844dd892c6e63e87d5122f8d1a03 100644
--- a/o2web/source/o2_core/o2/xAction/services/x_report_assemble_control.js
+++ b/o2web/source/o2_core/o2/xAction/services/x_report_assemble_control.js
@@ -7,14 +7,14 @@ MWF.xAction.RestActions.Action["x_report_assemble_control"] = new Class({
         this.action.getActions(function(){
             var url = this.action.actions.statByKeyWork.uri;
             url = url.replace("{year}", encodeURIComponent(year));
-            window.open(this.action.address+url);
+            window.open(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
     getExportFileStream: function(id){
         this.action.getActions(function(){
             var url = this.action.actions.exportStatResult.uri;
             url = url.replace("{id}", encodeURIComponent(id));
-            window.open(this.action.address+url, "_blank");
+            window.open(o2.filterUrl(this.action.address+url), "_blank");
         }.bind(this));
     }
     //statByUnit : function( year, success,failure, async){
diff --git a/o2web/source/o2_core/o2/xAction/services/x_strategydeploy_assemble_control.js b/o2web/source/o2_core/o2/xAction/services/x_strategydeploy_assemble_control.js
index 17a1c47f2a5cde6bfe44cd268a26d905c80e6148..5d06167fc6b07e598465a4cdbfc0beca4b38e47c 100644
--- a/o2web/source/o2_core/o2/xAction/services/x_strategydeploy_assemble_control.js
+++ b/o2web/source/o2_core/o2/xAction/services/x_strategydeploy_assemble_control.js
@@ -154,7 +154,7 @@ MWF.xAction.RestActions.Action["x_strategydeploy_assemble_control"] = new Class(
             var url = this.action.actions.getPriorityAttachmentData.uri;
             url = url.replace("{id}", encodeURIComponent(id));
             url = url.replace("{workId}", encodeURIComponent(workId));
-            window.open(this.actionAttachment.address+url);
+            window.open(o2.filterUrl(this.actionAttachment.address+url));
         }.bind(this));
     },
     getPriorityAttachmentStream: function(id, workId){
@@ -162,7 +162,7 @@ MWF.xAction.RestActions.Action["x_strategydeploy_assemble_control"] = new Class(
             var url = this.action.actions.getPriorityAttachmentStream.uri;
             url = url.replace("{id}", encodeURIComponent(id));
             url = url.replace("{workId}", encodeURIComponent(workId));
-            window.open(this.action.address+url);
+            window.open(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },
     ///////////////////////////五项///////////////////////////////
diff --git a/o2web/source/o2_core/o2/xAction/services/x_teamwork_assemble_control.js b/o2web/source/o2_core/o2/xAction/services/x_teamwork_assemble_control.js
index 76fb046885c9fd1132d829afe1234edbb7916eb8..e5de70b16e487cb20ffac53811a34d54b9434012 100644
--- a/o2web/source/o2_core/o2/xAction/services/x_teamwork_assemble_control.js
+++ b/o2web/source/o2_core/o2/xAction/services/x_teamwork_assemble_control.js
@@ -18,7 +18,7 @@ MWF.xAction.RestActions.Action["x_teamwork_assemble_control"] = new Class({
             var url = this.action.actions.attachmentDownload.uri;
             url = url.replace("{id}", encodeURIComponent(id));
             url = url.replace("{documentid}", encodeURIComponent(documentid));
-            window.open(this.actionAttachment.address+url);
+            window.open(o2.filterUrl(this.actionAttachment.address+url));
         }.bind(this));
     },
     attachmentDownloadStream: function(id,documentid,callback){
@@ -26,7 +26,7 @@ MWF.xAction.RestActions.Action["x_teamwork_assemble_control"] = new Class({
             var url = this.action.actions.attachmentDownloadStream.uri;
             url = url.replace("{id}", encodeURIComponent(id));
             url = url.replace("{documentid}", encodeURIComponent(documentid));
-            window.open(this.action.address+url);
+            window.open(o2.filterUrl(this.action.address+url));
 
         }.bind(this));
     },
@@ -36,7 +36,7 @@ MWF.xAction.RestActions.Action["x_teamwork_assemble_control"] = new Class({
             var url = this.action.actions.attachmentDownload.uri;
             url = url.replace("{id}", encodeURIComponent(id));
             url = url.replace("{documentid}", encodeURIComponent(documentid));
-            if (callback) callback(this.action.address+url);
+            if (callback) callback(o2.filterUrl(this.action.address+url));
         }.bind(this));
     },