From c35cbb06e24e2e0d58e418d578936d95aa17ed8f Mon Sep 17 00:00:00 2001
From: JonnyWong16 <9099342+JonnyWong16@users.noreply.github.com>
Date: Sat, 15 Jan 2022 16:14:20 -0800
Subject: [PATCH] Remove tokens from downloaded config

---
 plexpy/webserve.py | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/plexpy/webserve.py b/plexpy/webserve.py
index 579d4d05..fa76cdbf 100644
--- a/plexpy/webserve.py
+++ b/plexpy/webserve.py
@@ -4838,13 +4838,24 @@ class WebInterface(object):
     def download_config(self, **kwargs):
         """ Download the Tautulli configuration file. """
         config_file = config.FILENAME
+        config_copy = os.path.join(plexpy.CONFIG.CACHE_DIR, config_file)
 
         try:
             plexpy.CONFIG.write()
+            shutil.copyfile(plexpy.CONFIG_FILE, config_copy)
         except:
             pass
 
-        return serve_download(plexpy.CONFIG_FILE, name=config_file)
+        try:
+            cfg = config.Config(config_copy)
+            cfg.PMS_TOKEN = ''
+            cfg.JWT_SECRET = ''
+            cfg.write()
+        except:
+            cherrypy.response.status = 500
+            return 'Error downloading config. Check the logs.'
+
+        return serve_download(config_copy, name=config_file)
 
     @cherrypy.expose
     @requireAuth(member_of("admin"))