A more secure method working in all modern browsers with javascript can be found here:
Install the websocketd server (single static linked binary)
download from http://websocketd.com/
Start the websocketd server:
./websocketd --port=8080 --devconsole ./command.sh
Write an HTML page and a small bash script
HTML:
<button type = "button"
onclick = ws.send("xterm\040#started")>xterm </button>
Javascript
open a websocket:
var ws = new WebSocket('ws://localhost:8080/');
Bash script(command.sh):
#!/bin/bash
export DISPLAY=:0.0
while read command
do
eval $command
done
more details:
http://www.bitkistl.com/2016/01/websockets-with-interactive-bash-script.html