Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1.0 of Nextcloud Server and Nextcloud Enterprise Server, when the log level was set to debug, the user_ldap app logged user passwords in plaintext into the log file. If the log file was then leaked or shared in any way the users' passwords would be leaked. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.11, 26.0.6, and 27.1.0 contain a patch for this issue. As a workaround, change config setting `loglevel` to `1` or higher (should always be higher than 1 in production environments).
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*
CFCB9CDB-F661-496E-86B7-25B228A3C90E
25.0.11
25.0.0
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
37949CD5-0B2D-40BE-83C8-E6A03CD0F7C9
25.0.11
25.0.0
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*
9E2008E1-AFAE-40F5-8D64-A019F2222AA2
26.0.6
26.0.0
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
4C98058B-06EF-446E-A39D-F436627469C1
26.0.6
26.0.0
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:-:*:*:*
B8F5C07F-E133-4C54-B9A7-95A38086B28A
27.1.0
27.0.0
cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:enterprise:*:*:*
E29703CE-0A92-47F3-96AE-0AC27641ECDF
27.1.0
27.0.0
OR
### ⚠️ This issue respects the following points: ⚠️

- [X] This is a **bug**, not a question or a configuration/webserver/proxy issue.
- [X] This issue is **not** already reported on Github _(I've searched it)_.
- [X] Nextcloud Server **is** up to date. See [Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule) for supported versions.
- [X] Nextcloud Server **is** running on 64bit capable CPU, PHP and OS.
- [X] I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/).

### Bug description

The user_ldap app seems to log all LDAP operations, including parameters, in plain text.

https://github.com/nextcloud/server/blob/b6d734375478c791a146e2ec5ad61ac1a699e436/apps/user_ldap/lib/LDAP.php#L320-L324

For the `ldap_bind` command this looks like

```
Calling LDAP function ldap_bind with parameters [{},"<full user DN>", "<plain text password"]
```

### Steps to reproduce

1. configure Nextcloud for LDAP user backend
2. connect external client (in my case Gnome online account)
3. trigger ldap_bind (e.g. by syncing the calendar in the client)
4. follow the `DEBUG` log

### Expected behavior

If logged, I would expect the line to not display the password, or to omit parameters completely:

```
Calling LDAP function ldap_bind with parameters [{},"<full user DN>", "********"]
```
or
```
Calling LDAP function ldap_bind
```

### Installation method

None

### Nextcloud Server version

26

### Operating system

Debian/Ubuntu

### PHP engine version

PHP 8.1

### Web server

Apache (supported)

### Database engine version

MariaDB

### Is this bug present after an update or on a fresh install?

None

### Are you using the Nextcloud Server Encryption module?

None

### What user-backends are you using?

- [ ] Default user-backend _(database)_
- [X] LDAP/ Active Directory
- [ ] SSO - SAML
- [ ] Other

### Configuration report

_No response_

### List of activated Apps

```shell
Enabled:
  - activity: 2.18.0
  - bruteforcesettings: 2.6.0                                                                                                                                   
  - calendar: 4.3.4                                                                                                                                             
  - circles: 26.0.0                                                                                                                                             
  - cloud_federation_api: 1.9.0                                                                                                                                 
  - comments: 1.16.0                                                                                                                                            
  - contacts: 5.2.0                                                                                                                                             
  - contactsinteraction: 1.7.0                                                                                                                                  
  - dashboard: 7.6.0                                                                                                                                            
  - dav: 1.25.0                                                                                                                                                 
  - federatedfilesharing: 1.16.0                                                                                                                                
  - federation: 1.16.0                                                                                                                                          
  - files: 1.21.1                                                                                                                                               
  - files_markdown: 2.4.0                                                                                                                                       
  - files_pdfviewer: 2.7.0                                                                                                                                      
  - files_rightclick: 1.5.0                                                                                                                                     
  - files_sharing: 1.18.0                                                                                                                                       
  - files_trashbin: 1.16.0                                                                                                                                      
  - files_versions: 1.19.1                                                                                                                                      
  - firstrunwizard: 2.15.0                                                                                                                                      
  - jitsi: 0.17.0                                                                                                                                               
  - logreader: 2.11.0       
  - lookup_server_connector: 1.14.0
  - nextcloud_announcements: 1.15.0
  - notes: 4.7.2
  - notifications: 2.14.0
  - oauth2: 1.14.0
  - onlyoffice: 7.8.0
  - password_policy: 1.16.0
  - photos: 2.2.0
  - privacy: 1.10.0
  - provisioning_api: 1.16.0
  - recommendations: 1.5.0
  - related_resources: 1.1.0-alpha1
  - serverinfo: 1.16.0
  - settings: 1.8.0
  - sharebymail: 1.16.0
  - support: 1.9.0
  - systemtags: 1.16.0
  - tasks: 0.15.0
  - text: 3.7.2
  - theming: 2.1.1
  - twofactor_backupcodes: 1.15.0
  - updatenotification: 1.16.0
  - user_ldap: 1.16.0
  - user_status: 1.6.0
  - viewer: 1.10.0
  - weather_status: 1.6.0
  - workflowengine: 2.8.0
Disabled:
  - admin_audit: 1.16.0
  - deck: 1.8.3 (installed 1.8.3)
  - documentserver_community: 0.1.13 (installed 0.1.13)
  - encryption: 2.14.0
  - files_external: 1.18.0 (installed 1.7.0)
  - survey_client: 1.14.0 (installed 1.4.0)
  - suspicious_login: 4.4.0
  - twofactor_totp: 8.0.0-alpha.0
```


### Nextcloud Signing status

_No response_

### Nextcloud Logs

_No response_

### Additional info

_No response_
[Bug]: user_ldap logs user passwords in plain text
This is a GitHub Issue
repo:server
owner:nextcloud
Title : [Bug]: user_ldap logs user passwords in plain text
Issue date:

--- start body ---
### ⚠️ This issue respects the following points: ⚠️

- [X] This is a **bug**, not a question or a configuration/webserver/proxy issue.
- [X] This issue is **not** already reported on Github _(I've searched it)_.
- [X] Nextcloud Server **is** up to date. See [Maintenance and Release Schedule](https://github.com/nextcloud/server/wiki/Maintenance-and-Release-Schedule) for supported versions.
- [X] Nextcloud Server **is** running on 64bit capable CPU, PHP and OS.
- [X] I agree to follow Nextcloud's [Code of Conduct](https://nextcloud.com/contribute/code-of-conduct/).

### Bug description

The user_ldap app seems to log all LDAP operations, including parameters, in plain text.

https://github.com/nextcloud/server/blob/b6d734375478c791a146e2ec5ad61ac1a699e436/apps/user_ldap/lib/LDAP.php#L320-L324

For the `ldap_bind` command this looks like

```
Calling LDAP function ldap_bind with parameters [{},"<full user DN>", "<plain text password"]
```

### Steps to reproduce

1. configure Nextcloud for LDAP user backend
2. connect external client (in my case Gnome online account)
3. trigger ldap_bind (e.g. by syncing the calendar in the client)
4. follow the `DEBUG` log

### Expected behavior

If logged, I would expect the line to not display the password, or to omit parameters completely:

```
Calling LDAP function ldap_bind with parameters [{},"<full user DN>", "********"]
```
or
```
Calling LDAP function ldap_bind
```

### Installation method

None

### Nextcloud Server version

26

### Operating system

Debian/Ubuntu

### PHP engine version

PHP 8.1

### Web server

Apache (supported)

### Database engine version

MariaDB

### Is this bug present after an update or on a fresh install?

None

### Are you using the Nextcloud Server Encryption module?

None

### What user-backends are you using?

- [ ] Default user-backend _(database)_
- [X] LDAP/ Active Directory
- [ ] SSO - SAML
- [ ] Other

### Configuration report

_No response_

### List of activated Apps

```shell
Enabled:
  - activity: 2.18.0
  - bruteforcesettings: 2.6.0                                                                                                                                   
  - calendar: 4.3.4                                                                                                                                             
  - circles: 26.0.0                                                                                                                                             
  - cloud_federation_api: 1.9.0                                                                                                                                 
  - comments: 1.16.0                                                                                                                                            
  - contacts: 5.2.0                                                                                                                                             
  - contactsinteraction: 1.7.0                                                                                                                                  
  - dashboard: 7.6.0                                                                                                                                            
  - dav: 1.25.0                                                                                                                                                 
  - federatedfilesharing: 1.16.0                                                                                                                                
  - federation: 1.16.0                                                                                                                                          
  - files: 1.21.1                                                                                                                                               
  - files_markdown: 2.4.0                                                                                                                                       
  - files_pdfviewer: 2.7.0                                                                                                                                      
  - files_rightclick: 1.5.0                                                                                                                                     
  - files_sharing: 1.18.0                                                                                                                                       
  - files_trashbin: 1.16.0                                                                                                                                      
  - files_versions: 1.19.1                                                                                                                                      
  - firstrunwizard: 2.15.0                                                                                                                                      
  - jitsi: 0.17.0                                                                                                                                               
  - logreader: 2.11.0       
  - lookup_server_connector: 1.14.0
  - nextcloud_announcements: 1.15.0
  - notes: 4.7.2
  - notifications: 2.14.0
  - oauth2: 1.14.0
  - onlyoffice: 7.8.0
  - password_policy: 1.16.0
  - photos: 2.2.0
  - privacy: 1.10.0
  - provisioning_api: 1.16.0
  - recommendations: 1.5.0
  - related_resources: 1.1.0-alpha1
  - serverinfo: 1.16.0
  - settings: 1.8.0
  - sharebymail: 1.16.0
  - support: 1.9.0
  - systemtags: 1.16.0
  - tasks: 0.15.0
  - text: 3.7.2
  - theming: 2.1.1
  - twofactor_backupcodes: 1.15.0
  - updatenotification: 1.16.0
  - user_ldap: 1.16.0
  - user_status: 1.6.0
  - viewer: 1.10.0
  - weather_status: 1.6.0
  - workflowengine: 2.8.0
Disabled:
  - admin_audit: 1.16.0
  - deck: 1.8.3 (installed 1.8.3)
  - documentserver_community: 0.1.13 (installed 0.1.13)
  - encryption: 2.14.0
  - files_external: 1.18.0 (installed 1.7.0)
  - survey_client: 1.14.0 (installed 1.4.0)
  - suspicious_login: 4.4.0
  - twofactor_totp: 8.0.0-alpha.0
```


### Nextcloud Signing status

_No response_

### Nextcloud Logs

_No response_

### Additional info

_No response_
--- end body ---

comments :
--- start comments ---

--- end comments ---