From f626f55f8b97050a5e3c5cf69cb413e38fff7639 Mon Sep 17 00:00:00 2001
From: Oliver <oliver@derez.ai>
Date: Sun, 7 Jun 2026 19:06:56 -0300
Subject: [PATCH] use hidden form POST w/ target=_blank so 302 redirect opens
 in new tab, no CORS

---
 index.html | 76 +++++++++++++++++++++---------------------------------
 1 file changed, 30 insertions(+), 46 deletions(-)

diff --git a/index.html b/index.html
index 894d2ab..910b95d 100644
--- a/index.html
+++ b/index.html
@@ -2417,54 +2417,38 @@
             }
 
             try {
-                const res = await fetch(ORDER_WEBHOOK, {
-                    method: 'POST',
-                    redirect: 'manual',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        product: product,
-                        agent: agent,
-                        period: period,
-                        location: location,
-                        email: email || null,
-                        coupon: coupon || null,
-                        utm_source: document.getElementById('utm_source').value || null,
-                        utm_medium: document.getElementById('utm_medium').value || null,
-                        utm_campaign: document.getElementById('utm_campaign').value || null,
-                        utm_term: document.getElementById('utm_term').value || null,
-                        utm_content: document.getElementById('utm_content').value || null,
-                    }),
+                // Use a hidden form POST so the 302 redirect opens naturally in the new tab
+                const form = document.createElement('form');
+                form.method = 'POST';
+                form.action = ORDER_WEBHOOK;
+                form.target = '_blank';
+                form.style.display = 'none';
+
+                const fields = {
+                    product: product,
+                    agent: agent,
+                    period: period,
+                    location: location,
+                    email: email || '',
+                    coupon: coupon || '',
+                    utm_source: document.getElementById('utm_source').value || '',
+                    utm_medium: document.getElementById('utm_medium').value || '',
+                    utm_campaign: document.getElementById('utm_campaign').value || '',
+                    utm_term: document.getElementById('utm_term').value || '',
+                    utm_content: document.getElementById('utm_content').value || '',
+                };
+
+                Object.keys(fields).forEach(function (key) {
+                    const inp = document.createElement('input');
+                    inp.type = 'hidden';
+                    inp.name = key;
+                    inp.value = fields[key];
+                    form.appendChild(inp);
                 });
 
-                // 3xx redirect — extract the Location header and open it
-                if (res.type === 'opaqueredirect' || (res.status >= 300 && res.status < 400)) {
-                    const location = res.headers.get('Location');
-                    if (location && location.startsWith('http')) {
-                        window.open(location, '_blank');
-                        return;
-                    }
-                }
-
-                // Non-redirect: try parsing the body for a URL
-                if (!res.ok) { console.error('Webhook error:', res.status); return; }
-
-                const ct = res.headers.get('content-type') || '';
-                let data;
-                if (ct.indexOf('json') !== -1) {
-                    data = await res.json();
-                } else {
-                    data = await res.text();
-                }
-
-                const checkoutUrl = (data && typeof data === 'object')
-                    ? (data.url || data.checkout_url || data.checkoutUrl || data.redirect || data.redirect_url)
-                    : null;
-
-                if (checkoutUrl && checkoutUrl.startsWith('http')) {
-                    window.open(checkoutUrl, '_blank');
-                } else if (typeof data === 'string' && data.startsWith('http')) {
-                    window.open(data, '_blank');
-                }
+                document.body.appendChild(form);
+                form.submit();
+                document.body.removeChild(form);
             } catch (err) {
                 console.error('Order webhook failed:', err);
             }