song_print: hide HTTP password in playlist

Added the uri_remove_auth() library function which strips username
and password from a HTTP URI, and use it in song_print_url().  This
allows you to add HTTP URIs to the playlist including secret username
and password, without disclosing it to all MPD clients.

1 files changed, 32 insertions, 0 deletions

diff --git a/src/uri.c b/src/uri.c
index 6a6ddf82..8c5ec4dc 100644
--- a/src/uri.c
+++ b/src/uri.c
@@ -35,3 +35,35 @@ uri_get_suffix(const char *uri)
 
 	return dot != NULL ? dot + 1 : NULL;
 }
+
+char *
+uri_remove_auth(const char *uri)
+{
+	const char *auth, *slash, *at;
+	char *p;
+
+	if (strncmp(uri, "http://", 7) == 0)
+		auth = uri + 7;
+	else if (strncmp(uri, "https://", 8) == 0)
+		auth = uri + 8;
+	else
+		/* unrecognized URI */
+		return NULL;
+
+	slash = strchr(auth, '/');
+	if (slash == NULL)
+		slash = auth + strlen(auth);
+
+	at = memchr(auth, '@', slash - auth);
+	if (at == NULL)
+		/* no auth info present, do nothing */
+		return NULL;
+
+	/* duplicate the full URI and then delete the auth
+	   information */
+	p = g_strdup(uri);
+	memmove(p + (auth - uri), p + (at + 1 - uri),
+		strlen(at));
+
+	return p;
+}