Unsafe su - -c usage

Describe the bug
First of all, running GUI Applications as root should be avoided when possible.
But when needed, it at least should be safe.

To Reproduce
Steps to reproduce the behavior:

1. Login as a regular user
2. Execute the following:

cp /usr/share/applications/timeshift-gtk.desktop .local/share/applications/

sed -i "s|timeshift-launcher|env PATH=/home/`whoami`/.local/bin:\$PATH timeshift-launcher|" .local/share/applications/timeshift-gtk.desktop 

update-desktop-database .local/share/applications

cat << EOF > .local/bin/timeshift-gtk                                                       
#!/bin/bash
touch /pwned                           
EOF   

chmod +x .local/bin/timeshift-gtk

3. Now instead of launching timeshift, user will grant root permision to any possible malware
   Now try it yourself
   ls /pwned

Expected behavior
An absolute path should be used in timeshift-launcher to avoid security issue

Start by locating the code that invokes timeshift-launcher and inspect the su - -c usage implicated by the report. Reproduce the supplied desktop-entry setup, then verify that launching it uses an absolute executable path and no longer runs a user-controlled timeshift-launcher.