git-gui: avoid auto_execok in do_windows_shortcut

git-gui on Windows uses auto_execok to locate git-gui.exe,
which performs the same flawed search as does the builtin exec.
Use _which instead, performing a safe PATH lookup.

Signed-off-by: Mark Levedahl <redacted>
Signed-off-by: Johannes Sixt <redacted>
Signed-off-by: Taylor Blau <redacted>

diff --git a/lib/shortcut.tcl b/lib/shortcut.tcl
index 674a41f5e0c868b70d84202381fec8b5919f962f..263f4899c9e94a8fb5855244e15be0e8b25b6b37 100644 (file)
--- a/lib/shortcut.tcl
+++ b/lib/shortcut.tcl
@@ -12,7 +12,7 @@ proc do_windows_shortcut {} {
                        set fn ${fn}.lnk
                }
                # Use git-gui.exe if available (ie: git-for-windows)
-               set cmdLine [auto_execok git-gui.exe]
+               set cmdLine [list [_which git-gui]]
                if {$cmdLine eq {}} {
                        set cmdLine [list [info nameofexecutable] \
                                                         [file normalize $::argv0]]