7

Is there a way to execute a bash command when I click on a text in a browser?

The web page is on computer A, the browser is on computer B : I want to execute the code on computer B, e.g hsetroot to change the wallpaper when clicking an image.

4

Not really, no. That is the mother of all security holes. You are asking if you can set up a webpage that executes arbitrary commands on the client's machine. What if I set up a webpage that runs this command:

rm -rf ~/

That would delete all files in your $HOME. In fact, there was recently an uproar when a bug was discovered that allowed this to happen. One of the possible attack vectors was tricking the client (computer B in your case) into running a bash command.

So no, you can't execute arbitrary code on your local machine through a web browser. Not without somehow logging in first. You can run JavaScript or similar language commands but they won't have access to your user's session.

  • Thank for the answer, i understand the obvious issue there. I'm trying to achieve that with a custom browser : stackoverflow.com/questions/30963508/… – bob dylan Jun 21 '15 at 10:38
  • @bobdylan I don't think that's possible. I certainly hope it isn't anyway. That's a cool little program, by the way. I had no idea it was that simple to do! The point, however, is that I don't think it is possible to initiate a local shell session from the browser. – terdon Jun 21 '15 at 10:55
  • Well let's say i want to make an hybrid website / program with some functionality linked to my OS. So my browser won't be a normal "browser". So i don't see how it's not possible. – bob dylan Jun 21 '15 at 10:58
  • Certainly it’s possible for a program to do.  Consider: there’s no difference, in principle, between an FTP client and a browser (an HTTP client) — both interact with a local user and with a server.  Trivially, the FTP client can modify local files and execute (some) local commands.  Sure, it’s only at the request of the user, but that’s not a real constraint.  So a browser can do the same.  I heard, about ten years ago, that some of the major browsers had a security setting so low that they allowed this, but I don’t recall details, and things have probably been tightened up since then. – G-Man Jun 21 '15 at 13:26
  • @G-Man I don't know if it's possible for a click to be passed back to the browser and cause a shell session to start. FTP is very different since that initiates a session by definition. I'm not saying it's 100% impossible, I don't really know, I just think it's impossible and it's certainly not possible with existing browsers. – terdon Jun 21 '15 at 13:32
2

You cannot do that in general, but in a defined environment, where you can control the client machine B, you can propose that machine B runs a setroot service, you can simply write on your own with nodejs or golang for example and talk to that service when you receive the event. But in any case you don't have any chance (or at least you never should have a chance) if you don't install some extra service on machine B.

  • I've never used NodeJs before. You mean i can use a simple javascript like : run("whatever command on machine B"); ? – bob dylan Jun 25 '15 at 3:57
  • yes, nodejs is very simple to use for such reduced needs. – ikrabbe Jun 25 '15 at 6:11
  • @ikrabbe: Congratulations on reaching 500 reputation.  (And, BTW, cute gravatar.  Just don't let your super-squirrel loose near my cats!  :-) – G-Man Jun 29 '15 at 18:14
2

I solve it using a nodeJS server. (not clean/final code but its working)

Computer A : (server)

function change_wallpaper(image){
    var objReq = new XMLHttpRequest();
    objReq.open("GET", "http://localhost:8888" + "?image=" + image, false);
    objReq.send(null);
}
<img src="./img/1.jpeg" onclick="change_wallpaper(this.src);" />
<img src="./img/2.jpeg" onclick="change_wallpaper(this.src);" />

Computer B : (client) file called server.js ans executed with nodejs server.js

var http = require("http");
var sys = require('sys')
var exec = require('child_process').exec;
var url = require("url");

function onRequest(request, response) {
    var params = url.parse(request.url,true).query;
    function puts(error, stdout, stderr) {sys.puts(stdout)}
    exec("/usr/bin/feh --bg-center " + params.image, puts);
    response.writeHead(200, {'Content-Type': 'text/plain'});
    response.end('Wallpaper');
}

http.createServer(onRequest).listen(8888);
  • as my answer led you to the method to use, you asked for, it would have been nice to just ask for an edit for my answer, including your code and except it as I describe a method to execute a shell command, as you asked for and its a general approach. Writing portable services for client machines can do many, many things. If you would vote for my answer that would be ok too. – ikrabbe Jun 25 '15 at 6:10
  • @ikrabbe the OP can't vote, they don't have the rep. As for accepting, yes your answer (which I did upvote) did indeed give them a pointer but you didn't explain how they could use nodejs nor did you give an example. Your answer was very useful but it didn't really solve the OP's problem, it only pointed them in the right direction. Posting their own answer and accepting it is perfectly OK. – terdon Jun 29 '15 at 18:17
0

PHP can change content of textfiles cross the browser for example in /var/www/.../folder/mytextfie.txt You have only to get the string from that file, whitch can be a command or even command to start a script file.

a cronjob can run to check wether that textfile contains any executable.

#!/usr/bin/env bash
echo $(cat /var/www/.../folder/commandsperline.txt)
#or 
while read line
    do
    echo "$(${line})"
done< "/var/www/.../folder/commandsperline.txt"

context of that textfile:

#!/bin bash
#you need to declare absolute path
# chmod 755 /home/user/*.sh -to make executabble all scripts there
/home/user/backup.sh
/home/user/anyscript.sh

With te while loop it is possible to execute commands from that text-file.

0

Yes.. it is possible with neutralinojs.

You can use Neutralino.os.runCommand(). But in your scenario Neutralino cloud mode can be used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.