copyparty: never send the password to foreign hosts

1 files changed, 6 insertions, 2 deletions

diff --git a/src/commands/utilities.rs b/src/commands/utilities.rs
index b77f44d..33d732f 100644
--- a/src/commands/utilities.rs
+++ b/src/commands/utilities.rs
@@ -4,7 +4,7 @@ use tracing::warn;
 use super::autocomplete::any_file;
 use crate::music::sanitize_yt_url;
 use crate::Data;
-use crate::copyparty::{html_decode, percent_decode};
+use crate::copyparty::{html_decode, percent_decode, redact_url};
 use crate::error::{Error, Result};
 use crate::lang;
 
@@ -502,7 +502,11 @@ async fn run_download(
         let stderr = String::from_utf8_lossy(&output.stderr);
         // Keep the full yt-dlp trace in the logs; the user only sees the
         // short `fmt_download_failed` (translated) message.
-        warn!(url = %url, "yt-dlp failed:\n{}", stderr.trim_end());
+        warn!(
+            url = %redact_url(url),
+            "yt-dlp failed:\n{}",
+            stderr.trim_end()
+        );
         let _ = tokio::fs::remove_dir_all(&dl_dir).await;
         ctx.say(lang::fmt_download_failed(&stderr)).await?;
         return Ok(());