Question

-Hello, looking for some help.

We currently have a winform app used to do approvals in our company. The app sends html emails to the “approvers” who read the relevant info in the email and click on a hyperlink which launches the app so they can do their approval.

Currently this is done by including the following in the email html:

<a href=file:///C:\Temp\test.exe>Click to Approve</a>

This correctly launches the app, after a couple of security warnings which we are OK with. We use Outlook 2010.

Now, in order to improve this process I would need to pass an argument identifying the approver to the app. This works correctly if I pass the argument from, say, a windows shortcut, however, I cannot find a way to pass the argument to the exe in the href attribute in order to do it from the email. I looked everywhere, and found nothing except questions.

I have tried the following to no avail:

<a href=file:///C:\Temp\test.exe approverID>Click to Approve</a>
<a href=file:///C:\Temp\test.exe 'approverID'>Click to Approve</a>
<a href="file:///C:\Temp\test.exe approverID">Click to Approve</a>

Also I have tried doing it with JavaScript, which from an HTML page works fine, but not from an email in Outlook.

I thought maybe there is a security threat with this approach hence it is not possible, but if I can successfully from an email run an exe, why can I not run an exe with parameters? It doesnt make sense.

Thank you for your help.

Leo

Answer 1

after not getting any suitable responses and after continuing my research for this without success, I will temporarily conclude that what I am looking for is not possible. If the reasons for this not being possible concern security, then I am completely puzzled as to why running an exe without parameters is allowed and therefore considered LESS harmful than running an exe with parameters. Surely, an exe does not require parameters to be harmful. If anyone would care to elaborate on this, it would be educational for me, thank you.

Nevertheless, I have thought of an alternative to my problem, which is not as elegant as would otherwise be stating parameters in href, but it serves my purpose. Because our app is run from a network drive, I have changed it so that it creates user-specific cmd files on the network drive and the hyperlink in the email it creates points to these cmd instead of the exe. That way, the cmd files contains the call to the exe with the correct parameters and as the cmd files are very light and quickly written, this is OK.

I am closing this as “answered”, but it is not.

Thanks for taking your time to read.

Leo