wshom.ocx: Expand environment string before executing command through CreateProcessW.

dlls/wshom.ocx/shell.c

@@ -1714,6 +1714,9 @@ static HRESULT WINAPI WshShell3_SendKeys(IWshShell3 *iface, BSTR Keys, VARIANT *
 
 static HRESULT WINAPI WshShell3_Exec(IWshShell3 *iface, BSTR command, IWshExec **ret)
 {
+    BSTR expandedcmd;
+    HRESULT hr;
+
     TRACE("(%s %p)\n", debugstr_w(command), ret);
 
     if (!ret)
@@ -1722,7 +1725,13 @@ static HRESULT WINAPI WshShell3_Exec(IWshShell3 *iface, BSTR command, IWshExec *
     if (!command)
         return DISP_E_EXCEPTION;
 
-    return WshExec_create(command, ret);
+    hr = WshShell3_ExpandEnvironmentStrings(iface, command, &expandedcmd);
+    if (FAILED(hr))
+        return hr;
+
+    hr = WshExec_create(expandedcmd, ret);
+    SysFreeString(expandedcmd);
+    return hr;
 }
 
 static HRESULT WINAPI WshShell3_get_CurrentDirectory(IWshShell3 *iface, BSTR *dir)

dlls/wshom.ocx/tests/wshom.c

@@ -327,6 +327,16 @@ static void test_wshshell(void)
     ok(hr == HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND), "got 0x%08x\n", hr);
     SysFreeString(str);
 
+    str = SysAllocString(L"%deadbeaf% /c echo test");
+    hr = IWshShell3_Exec(sh3, str, &shexec);
+    ok(hr == HRESULT_FROM_WIN32(ERROR_FILE_NOT_FOUND), "got 0x%08x\n", hr);
+    SysFreeString(str);
+
+    str = SysAllocString(L"%ComSpec% /c echo test");
+    hr = IWshShell3_Exec(sh3, str, &shexec);
+    ok(hr == HRESULT_FROM_WIN32(ERROR_SUCCESS), "got 0x%08x\n", hr);
+    SysFreeString(str);
+
     IWshCollection_Release(coll);
     IDispatch_Release(disp);
     IWshShell3_Release(sh3);