From 45203dac5914c2abd60371ab552d2838048b3ef1 Mon Sep 17 00:00:00 2001
From: Fringg <egor.andrianovv@gmail.com>
Date: Mon, 9 Mar 2026 21:53:55 +0300
Subject: [PATCH] fix: remove noreferrer from payment links to preserve Referer
 header

WATA DDoS Guard blocks requests without Referer (403 error).
Removed noreferrer from window.open and <a> tags on payment URLs.
noopener alone is sufficient for security (prevents window.opener access).
---
 src/components/blocking/ChannelSubscriptionScreen.tsx | 2 +-
 src/pages/AdminPayments.tsx                           | 2 +-
 src/platform/adapters/WebAdapter.ts                   | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/components/blocking/ChannelSubscriptionScreen.tsx b/src/components/blocking/ChannelSubscriptionScreen.tsx
index 88a2cfe..0f77094 100644
--- a/src/components/blocking/ChannelSubscriptionScreen.tsx
+++ b/src/components/blocking/ChannelSubscriptionScreen.tsx
@@ -10,7 +10,7 @@ function safeOpenUrl(url: string | undefined | null): void {
   try {
     const parsed = new URL(url);
     if (parsed.protocol === 'https:' || parsed.protocol === 'http:') {
-      window.open(url, '_blank', 'noopener,noreferrer');
+      window.open(url, '_blank', 'noopener');
     }
   } catch {
     // invalid URL, do nothing
diff --git a/src/pages/AdminPayments.tsx b/src/pages/AdminPayments.tsx
index 3769529..95b8a42 100644
--- a/src/pages/AdminPayments.tsx
+++ b/src/pages/AdminPayments.tsx
@@ -228,7 +228,7 @@ export default function AdminPayments() {
                         <a
                           href={payment.payment_url}
                           target="_blank"
-                          rel="noopener noreferrer"
+                          rel="noopener"
                           className="btn-secondary px-3 py-1.5 text-xs"
                         >
                           {t('admin.payments.openLink')}
diff --git a/src/platform/adapters/WebAdapter.ts b/src/platform/adapters/WebAdapter.ts
index a75667a..0e90ff4 100644
--- a/src/platform/adapters/WebAdapter.ts
+++ b/src/platform/adapters/WebAdapter.ts
@@ -203,11 +203,11 @@ export function createWebAdapter(): PlatformContext {
     },
 
     openLink(url: string, _options?: { tryInstantView?: boolean }) {
-      window.open(url, '_blank', 'noopener,noreferrer');
+      window.open(url, '_blank', 'noopener');
     },
 
     openTelegramLink(url: string) {
-      window.open(url, '_blank', 'noopener,noreferrer');
+      window.open(url, '_blank', 'noopener');
     },
 
     async share(text: string, url?: string): Promise<boolean> {