From 0628b23226569a6c2b5dfd1d2be27514210893b9 Mon Sep 17 00:00:00 2001
From: John Preston <johnprestonmail@gmail.com>
Date: Wed, 29 Apr 2026 23:02:13 +0700
Subject: [PATCH] Add two force-confirmation cases to hidden urls.

---
 .../SourceFiles/core/click_handler_types.cpp     | 16 +++++++++++++++-
 .../inline_bots/bot_attach_web_view.cpp          |  9 +++++----
 .../inline_bots/bot_attach_web_view.h            |  2 +-
 .../window/window_session_controller.cpp         |  1 +
 4 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/Telegram/SourceFiles/core/click_handler_types.cpp b/Telegram/SourceFiles/core/click_handler_types.cpp
index 1d1f20c7f4..3d8ba2377a 100644
--- a/Telegram/SourceFiles/core/click_handler_types.cpp
+++ b/Telegram/SourceFiles/core/click_handler_types.cpp
@@ -74,6 +74,19 @@ constexpr auto kReminderSetToastDuration = 4 * crl::time(1000);
 	return result;
 }
 
+[[nodiscard]] bool IsTelegramShortLinkHost(const QUrl &url) {
+	using namespace qthelp;
+
+	return regex_match(
+		"(^|\\.)(telegram\\.(me|dog)|t\\.me)$",
+		url.host(),
+		RegExOption::CaseInsensitive).valid();
+}
+
+[[nodiscard]] bool HiddenUrlRequiresConfirmation(const QUrl &url) {
+	return UrlRequiresConfirmation(url) || IsTelegramShortLinkHost(url);
+}
+
 // Possible context owners: media viewer, profile, history widget.
 
 void SearchByHashtag(ClickContext context, const QString &tag) {
@@ -254,7 +267,8 @@ void HiddenUrlClickHandler::Open(QString url, QVariant context) {
 		const auto parsedUrl = url.startsWith(u"tonsite://"_q)
 			? QUrl(url)
 			: QUrl::fromUserInput(url);
-		if (UrlRequiresConfirmation(parsedUrl) && !base::IsCtrlPressed()) {
+		if (HiddenUrlRequiresConfirmation(parsedUrl)
+			&& !base::IsCtrlPressed()) {
 			const auto my = context.value<ClickHandlerContext>();
 			if (!my.show) {
 				Core::App().hideMediaView();
diff --git a/Telegram/SourceFiles/inline_bots/bot_attach_web_view.cpp b/Telegram/SourceFiles/inline_bots/bot_attach_web_view.cpp
index 4b99329104..41f9d6aaea 100644
--- a/Telegram/SourceFiles/inline_bots/bot_attach_web_view.cpp
+++ b/Telegram/SourceFiles/inline_bots/bot_attach_web_view.cpp
@@ -937,7 +937,7 @@ void WebViewInstance::resolve() {
 	}, [&](WebViewSourceLinkBotProfile) {
 		confirmOpen([=] {
 			requestMain();
-		});
+		}, !_context.maySkipConfirmation);
 	}, [&](WebViewSourceLinkAttachMenu data) {
 		requestWithMenuAdd();
 	}, [&](WebViewSourceMainMenu) {
@@ -1039,9 +1039,10 @@ void WebViewInstance::resolveApp(
 	}).send();
 }
 
-void WebViewInstance::confirmOpen(Fn<void()> done) {
-	if (_bot->isVerified()
-		|| _session->local().isPeerTrustedOpenWebView(_bot->id)) {
+void WebViewInstance::confirmOpen(Fn<void()> done, bool forceConfirmation) {
+	if (!forceConfirmation
+		&& (_bot->isVerified()
+			|| _session->local().isPeerTrustedOpenWebView(_bot->id))) {
 		done();
 		return;
 	}
diff --git a/Telegram/SourceFiles/inline_bots/bot_attach_web_view.h b/Telegram/SourceFiles/inline_bots/bot_attach_web_view.h
index f1c35dafd0..1304584c63 100644
--- a/Telegram/SourceFiles/inline_bots/bot_attach_web_view.h
+++ b/Telegram/SourceFiles/inline_bots/bot_attach_web_view.h
@@ -252,7 +252,7 @@ private:
 		const QString &appname,
 		const QString &startparam,
 		ConfirmType confirmType);
-	void confirmOpen(Fn<void()> done);
+	void confirmOpen(Fn<void()> done, bool forceConfirmation = false);
 	void confirmAppOpen(
 		bool writeAccess,
 		Fn<void(bool allowWrite)> done,
diff --git a/Telegram/SourceFiles/window/window_session_controller.cpp b/Telegram/SourceFiles/window/window_session_controller.cpp
index 9f1fa45258..2abe006229 100644
--- a/Telegram/SourceFiles/window/window_session_controller.cpp
+++ b/Telegram/SourceFiles/window/window_session_controller.cpp
@@ -798,6 +798,7 @@ void SessionNavigation::showPeerByLinkResolved(
 				.context = {
 					.controller = parentController(),
 					.fullscreen = info.botAppFullScreen,
+					.maySkipConfirmation = !info.botAppForceConfirmation,
 				},
 				.button = { .startCommand = startCommand },
 				.source = InlineBots::WebViewSourceLinkBotProfile{