diff --git a/wwwroot/api/contract_attach.ui b/wwwroot/api/contract_attach.ui
index f32df73..eb9e855 100644
--- a/wwwroot/api/contract_attach.ui
+++ b/wwwroot/api/contract_attach.ui
@@ -46,7 +46,7 @@
                 "wid": "self",
                 "event": "changed",
                 "actiontype": "script",
-                "script": "var files=this.value;if(!files||!files.length)return;var fd=new FormData();fd.append('folderid','{{folder}}');fd.append('fiid','{{fiid}}');for(var i=0;i<files.length;i++)fd.append('upfile',files[i]);var self=this;fetch('{{entire_url('contract_upload.dspy')}}',{method:'POST',body:fd}).then(function(r){if(r.ok){var tbl=bricks.getWidgetById('attach_tbl');if(tbl)tbl.render({});self.value=null;}}).catch(function(e){console.error('upload failed',e)})"
+                "script": "var files=this.value;if(!files||!files.length)return;var fd=new FormData();fd.append('folderid','{{folder}}');fd.append('fiid','{{fiid}}');for(var i=0;i<files.length;i++)fd.append('upfile',files[i]);var self=this;fetch('{{entire_url('contract_upload.dspy')}}',{method:'POST',body:fd}).then(function(r){return r.json()}).then(function(r){var msg=r;var tbl=bricks.getWidgetById('attach_tbl');if(tbl){tbl.old_params=null;tbl.render({});}self.value=null;if(msg.widgettype)bricks.widgetBuild(msg).then(function(w){if(w)w.open()});}).catch(function(e){console.error('upload failed',e);alert('上传失败: '+e.message);})"
             }]
         },
         {
@@ -81,14 +81,14 @@
                     "event": "download",
                     "actiontype": "script",
                     "target": "self",
-                    "script": "var d=this.select_row.user_data;if(d&&d.webpath)window.open(d.webpath,'_blank')"
+                    "script": "var d=this.select_row.user_data;if(d&&d.webpath)window.open(d.webpath,'_blank');else alert('无法获取文件路径')"
                 },
                 {
                     "wid": "self",
                     "event": "delete_attach",
                     "actiontype": "script",
                     "target": "self",
-                    "script": "var d=this.select_row.user_data;if(!d||!d.id)return;if(!confirm('确定删除 '+d.filename+' ？'))return;var self=this;fetch('{{delete_url}}?id='+d.id+'&fiid={{fiid}}',{method:'POST'}).then(function(r){return r.json()}).then(function(r){if(r.widgettype==='Message'){self.render({})}else{alert(r.options.message)}})"
+                    "script": "var d=this.select_row.user_data;if(!d||!d.id)return;if(!confirm('确定删除 '+d.filename+' ？'))return;var self=this;fetch('{{delete_url}}?id='+encodeURIComponent(d.id)+'&fiid={{fiid}}',{method:'POST'}).then(function(r){return r.json()}).then(function(r){if(r.widgettype==='Message'){self.old_params=null;self.render({});}else if(r.widgettype==='Error'){alert(r.options.message);}else{alert(JSON.stringify(r));}}).catch(function(e){console.error('delete failed',e);alert('删除失败: '+e.message);})"
                 }
             ]
         }