From: Jouni Malinen <jouni@qca.qualcomm.com>
Date: Mon, 6 Oct 2014 15:50:00 +0000 (+0300)
Subject: browser-system: Use more robust mechanism for starting browser
X-Git-Tag: hostap_2_3~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=17dc39a8bc218ab91e1443288f4eba7e9a101247;p=thirdparty%2Fhostap.git

browser-system: Use more robust mechanism for starting browser

Use os_exec() to run the external browser to avoid undesired command
line processing for control interface event strings. Previously, it
could have been possible for some of the event strings to include
unsanitized data which is not suitable for system() use.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
---

diff --git a/src/utils/browser-system.c b/src/utils/browser-system.c
index 2884d341d..a080e2cb9 100644
--- a/src/utils/browser-system.c
+++ b/src/utils/browser-system.c
@@ -92,7 +92,7 @@ int hs20_web_browser(const char *url)
 		return -1;
 	}
 
-	if (system(cmd) != 0) {
+	if (os_exec("/usr/bin/x-www-browser", url, 0) != 0) {
 		wpa_printf(MSG_INFO, "Failed to launch browser");
 		eloop_cancel_timeout(browser_timeout, NULL, NULL);
 		http_server_deinit(http);