[Bug]: Certain kinds of log lines can output sensitive information in the logs

[akhil1508]

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

• if a user is using BASIC auth for a dav call and the user is disabled, there is a DisabledUserException in the logs
• This exception used to redact sensitive information properly earlier
• But recently it seems to output the username and password in plain text in the logs
• Issue seems to stem from 121973d336e

Steps to reproduce

1. Disable a user using occ user:disable $uid
2. Do a sync call to a dav route for the user using BASIC auth with username:password
3. See the logs that are produced - the credentials are not redacted as sensitive information

Expected behavior

• Redacted credentials in the logs

Nextcloud Server version

33

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

No response

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

[icewind1991]

I don't see the password in the logs when doing the reproduction steps

[susnux]

#64337