From 17dc39a8bc218ab91e1443288f4eba7e9a101247 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Mon, 6 Oct 2014 18:50:00 +0300 Subject: [PATCH] browser-system: Use more robust mechanism for starting browser Use os_exec() to run the external browser to avoid undesired command line processing for control interface event strings. Previously, it could have been possible for some of the event strings to include unsanitized data which is not suitable for system() use. Signed-off-by: Jouni Malinen --- src/utils/browser-system.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/utils/browser-system.c b/src/utils/browser-system.c index 2884d341d..a080e2cb9 100644 --- a/src/utils/browser-system.c +++ b/src/utils/browser-system.c @@ -92,7 +92,7 @@ int hs20_web_browser(const char *url) return -1; } - if (system(cmd) != 0) { + if (os_exec("/usr/bin/x-www-browser", url, 0) != 0) { wpa_printf(MSG_INFO, "Failed to launch browser"); eloop_cancel_timeout(browser_timeout, NULL, NULL); http_server_deinit(http);