1

I have a webpage that needs to run a program by ActiveX with some parameters.
I get those parameters with the following bit of JavaScript:

var var1 = getUrlParameter("par1", false);
var var2 = getUrlParameter("par2", false);
var var3 = getUrlParameter("par3", true);
var var4 = getUrlParameter("par4", true);

I'm creating a new ActiveX Object:

MyObject = new ActiveXObject("WScript.Shell")

Then I need to run a command, I've tried several options with double and single quotes but nothing works. Sometimes the program isn't started at all, sometimes the variables aren't getting through. I've tried:

MyObject.Run(""C:\\Path with\\some spaces\\program.exe" D:\\pathtoafile /PARAM:/para1="+var1+"\,/para2="+var2+"\,/para3="+var3+"\,/para4=\""+var4+"\"");
MyObject.Run('"C:\\Path with\\some spaces\\program.exe" D:\\pathtoafile /PARAM:/para1="+var1+"\,/para2="+var2+"\,/para3="+var3+"\,/para4=\""+var4+"\"');
MyObject.Run("'C:\\Path with\\some spaces\\program.exe' D:\\pathtoafile /PARAM:/para1="+var1+"\,/para2="+var2+"\,/para3="+var3+"\,/para4=\""+var4+"\"");
Dnns
  • 31
  • 1
  • 5
  • I think you should rename your variables as I suspect they are not valid names. Try maybe p1, p2, p3, p4 instead for example. Also if this is being run from a webpage I would expect that the `WScript.Shell` ActiveX object is blocked as an un-safe object. Otherwise a malicious website could run any command on your system. – AeroX Dec 29 '14 at 10:44
  • In addition what AeroX has said: ActiveXes work in IE only if allowed (I wouldn't allow any web-page to run ActiveXes though). – Teemu Dec 29 '14 at 10:52
  • ActiveX is allowed. I test it with "alert" that's how i can see when the vars are passed through. – Dnns Dec 29 '14 at 11:00

1 Answers1

1

After some more hours of trying if found it!

MyObject.Run('"C:\\Path with\\some spaces\\program.exe"' + " " + "D:\\pathtoafile" + " " +  "/PARAM:/para1="+var1+"\,/para2="+var2+"\,/para3="+var3+"\,/para4=\""+var4+"\"");
Dnns
  • 31
  • 1
  • 5