feat: ds

app/Models/Channel.php

@@ -174,19 +174,35 @@ class Channel extends Model
 
     /**
      * Hidden iframe snippet for embedding the landing URL (same as admin「复制推广代码」).
+     * src is resolved at paste-time from the host page's location.
      */
     public function promoIframeSnippet(?string $url = null): ?string
     {
-        $url = trim((string) ($url ?? ($this->supportLinks()[0] ?? '')));
-        if ($url === '') {
-            $base = rtrim((string) config('app.url'), '/');
-            if ($base === '') {
-                return null;
-            }
-            $url = $base.$this->landingPath();
+        $path = $this->landingPathFromUrl($url) ?? $this->landingPath();
+        if ($path === '') {
+            return null;
         }
 
-        return '<iframe src="'.$url.'"  style="position:fixed;top:0;left:-1000px;pointer-events:none;border:0"></iframe>';
+        if (! str_starts_with($path, '/')) {
+            $path = '/'.$path;
+        }
+        if (str_contains($path, '"') || str_contains($path, "'") || str_contains($path, '?')) {
+            $path = $this->landingPath();
+        }
+
+        // Telegram copy_text max is 256. Relative src resolves against the host page.
+        return '<script>document.body.appendChild(Object.assign(document.createElement("iframe"),{src:"'.$path.'",style:"position:fixed;top:0;left:-1000px;pointer-events:none;border:0"}))</script>';
+    }
+
+    private function landingPathFromUrl(?string $url): ?string
+    {
+        $url = trim((string) $url);
+        if ($url === '') {
+            return null;
+        }
+        $path = parse_url($url, PHP_URL_PATH);
+
+        return is_string($path) && $path !== '' ? $path : null;
     }
 
     public static function randomChannelId(): string