Language: PHP
Label: vulnerable
CWE: CWE-532 \u2014 Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Code:
function authorizationToUser() {
	//Input is 'GoogleLogin auth', but PHP replaces spaces by '_'	http://php.net/language.variables.external
	$headerAuth = headerVariable('Authorization', 'GoogleLogin_auth');
	if ($headerAuth != '') {
		$headerAuthX = explode('/', $headerAuth, 2);
		if (count($headerAuthX) === 2) {
			$user = $headerAuthX[0];
			if (FreshRSS_user_Controller::checkUsername($user)) {
				FreshRSS_Context::initUser($user);
				if (FreshRSS_Context::$user_conf == null) {
					Minz_Log::warning('Invalid API user ' . $user . ': configuration cannot be found.');
					unauthorized();
				}
				if (!FreshRSS_Context::$user_conf->enabled) {
					Minz_Log::warning('Invalid API user ' . $user . ': configuration cannot be found.');
					unauthorized();
				}
				if ($headerAuthX[1] === sha1(FreshRSS_Context::$system_conf->salt . $user . FreshRSS_Context::$user_conf->apiPasswordHash)) {
					return $user;
				} else {
					Minz_Log::warning('Invalid API authorisation for user ' . $user . ': ' . $headerAuthX[1], API_LOG);
					Minz_Log::warning('Invalid API authorisation for user ' . $user . ': ' . $headerAuthX[1]);
					unauthorized();
				}
			} else {
				badRequest();
			}
		}
	}
	return '';
}