Title: Stories: API allows non-Premium users to create custom repost cards with arbitrary clickable areas
Description:
Non-Premium users can only repost channel posts to Stories — no links or buttons (Premium-only). Official clients generate a default card with a limited clickable area.
However, via the Telegram API, a non-Premium user can send a story with fwd_from referencing any channel post and:
Attach custom media completely unrelated to the original post
Define mediaAreaChannelPost of any size, covering the entire story
Add styled visual elements (e.g. an "Open Post" button) mimicking Premium features
This effectively bypasses Premium restrictions — the result is a fully custom, clickable story without a subscription.
Steps to reproduce:
Use a non-Premium account
Via API, send a story with fwd_from pointing to any channel post
Attach custom media, define a large mediaAreaChannelPost
The story displays a custom clickable card across all clients
Expected: API should enforce the same restrictions as official clients — standardize card appearance and clickable area for non-Premium reposts.
Actual: No restrictions on card customization or clickable area size for non-Premium users.
Platforms: All (created via API, displayed everywhere)
Steps to reproduce
Steps to reproduce:
Have a non-Premium Telegram account.
Pick any public channel post (e.g. @channel, message ID 123).
Using the Telegram API, call stories.sendStory with the following:
media: any custom image/video (not from the original post)
fwd_from_id: the channel peer
fwd_from_story: the message ID
media_areas: a mediaAreaChannelPost with coordinates covering the entire story area (e.g. x=50, y=50, w=100, h=100)
Open the published story from any official Telegram client (iOS / Android / Desktop).
The story displays a fully custom card with a clickable area spanning the entire story, redirecting to the referenced post — all without Premium.
Expected: The API should restrict non-Premium users to the same default card layout and limited clickable area as official clients generate.
Actual: The API allows arbitrary media, layout, and clickable area size with no Premium check.