diff --git a/public/my.js b/public/my.js index ee99b10..fd9e471 100644 --- a/public/my.js +++ b/public/my.js @@ -312,12 +312,38 @@ const tb=document.getElementById('tgLinkBtn'); tb.addEventListener('click',async function(){ tb.disabled=true; + const note=document.getElementById('tgLinkNote'); try{ const r=await(await fetch('/api/public/tg-link',{method:'POST'})).json(); - if(r.url){window.open(r.url,'_blank','noopener');document.getElementById('tgLinkNote').textContent='Tap START in Telegram to finish linking.';} - else document.getElementById('tgLinkNote').textContent=r.error||'Try again shortly.'; - }catch(e){document.getElementById('tgLinkNote').textContent='Network hiccup — try again.';} - tb.disabled=false; + if(!r.url){ note.textContent=r.error||'Try again shortly.'; tb.disabled=false; return; } + + // Do NOT call window.open here. Wallet DApp browsers (Trust, SafePal, + // MetaMask) block programmatic window.open, so the call silently does + // nothing and the member is left looking at an unchanged screen with + // no idea anything happened. A real anchor the member taps is handled + // by the OS, which is what actually launches the Telegram app — + // and a copy button covers the webviews that refuse even that. + note.textContent=''; + foot.insertAdjacentHTML('beforeend', + '