song_print: hide HTTP password in playlist

Added the uri_remove_auth() library function which strips username
and password from a HTTP URI, and use it in song_print_url().  This
allows you to add HTTP URIs to the playlist including secret username
and password, without disclosing it to all MPD clients.

1 files changed, 11 insertions, 1 deletions

diff --git a/src/song_print.c b/src/song_print.c
index 60e16f94..1b62f324 100644
--- a/src/song_print.c
+++ b/src/song_print.c
@@ -22,6 +22,7 @@
 #include "directory.h"
 #include "tag_print.h"
 #include "client.h"
+#include "uri.h"
 
 void
 song_print_url(struct client *client, struct song *song)
@@ -30,7 +31,16 @@ song_print_url(struct client *client, struct song *song)
 		client_printf(client, "%s%s/%s\n", SONG_FILE,
 			      directory_get_path(song->parent), song->url);
 	} else {
-		client_printf(client, "%s%s\n", SONG_FILE, song->url);
+		char *allocated;
+		const char *uri;
+
+		uri = allocated = uri_remove_auth(song->url);
+		if (uri == NULL)
+			uri = song->url;
+
+		client_printf(client, "%s%s\n", SONG_FILE, uri);
+
+		g_free(allocated);
 	}
 }