From ade40a078213c13e093623429bf7c3743c756f3b Mon Sep 17 00:00:00 2001 From: Agando Date: Mon, 2 Nov 2026 22:02:45 +0100 Subject: fix(auth-ui): stop offering a Telegram widget where it cannot work MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two hosts cannot complete the widget flow and both are in use: an Android WebView / in-app browser (the operator's phone UA ends "; wv)") and a desktop browser that blocks the popup or hands the link to the Telegram app. The widget needs a popup that can postMessage back into the opener; in those hosts the link lands in a browser tab or in Chrome with no opener, onTelegramAuth never fires, and the login card looks dead — "it opens my default browser" (reported twice: phone, then Max's laptop). modules/wx11-tg-webview.js (new) WX11TG.isWebView() -> "; wv)", Telegram in-app, Meta in-app UAs WX11TG.dropWidgets()-> removes already-rendered oauth.telegram.org iframes/scripts dashboard.html code box is open by default and drops the nested
WebView: widget removed + "cannot work inside an app window" hint desktop: if the widget was clicked and onTelegramAuth has not fired in 12 s, open the code flow with a hint instead of leaving a dead card spaces/newos4 (webdav-login panel) in a WebView the widget is never injected, the mount is hidden and the device-code flow starts by itself; desktop keeps the widget unchanged version v4.6.145 Measured with playwright (390x844 WebView UA and 1440x900 Chrome): WebView -> 0 Telegram iframes, hint shown, code box open, real WX11- code minted desktop -> widget still rendered, code box open, real WX11- code minted newOS4 WebView -> no widget injected, code area auto-visible, code WX11-..., no JS errors newOS4 desktop -> widget still offered --- modules/ext/webdav.js | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) (limited to 'modules/ext') diff --git a/modules/ext/webdav.js b/modules/ext/webdav.js index c7efbf9..a97a8bc 100644 --- a/modules/ext/webdav.js +++ b/modules/ext/webdav.js @@ -975,6 +975,13 @@ class WebDAVModule { } }; const mount = document.getElementById('wdav-tg-mount'); + // A Telegram widget cannot log anyone in inside an Android WebView or an in-app + // browser: it needs a popup that can postMessage back to the opener, and those hosts + // hand the link to the system browser, which has no opener. Measured 2026-11-02 (the + // operator's phone UA ends "...; wv)"): every attempt landed in Chrome and died there. + // In that case skip the widget entirely and start the code flow, which needs no popup. + const _tgWV = /;\s*wv\)/.test(navigator.userAgent || '') || + /\bTelegram\b/i.test(navigator.userAgent || ''); const tw = document.createElement('script'); tw.src = 'https://telegram.org/js/telegram-widget.js?22'; tw.setAttribute('data-telegram-login', 'roducbot'); @@ -982,7 +989,16 @@ class WebDAVModule { tw.setAttribute('data-onauth', 'webx11TgLogin(user)'); tw.setAttribute('data-request-access', 'write'); tw.async = true; - mount.appendChild(tw); + if (_tgWV) { + // The code button's handler is already bound above; just hide the widget and use it. + if (mount) mount.style.display = 'none'; + const _st = document.getElementById('wdav-tg-status'); + if (_st) _st.textContent = 'This app window cannot run the Telegram button — using a code instead.'; + const _cb = document.getElementById('wdav-code-btn'); + if (_cb) setTimeout(function () { _cb.click(); }, 0); + } else { + mount.appendChild(tw); + } document.getElementById('wdav-login-btn').onclick = async function () { const u = (document.getElementById('wdav-user').value || '').trim().toLowerCase(); const pw = document.getElementById('wdav-pass').value || ''; -- cgit v1.2.3