$g_log_destination = 'file:/our/logfile.log';
$g_log_level = LOG_EMAIL | LOG_WEBSERVICE;

when there is an application error (in our case the logfile wasn't writable) the error message gets written into the standard server log (using nginx) the user credentials of the user making a SOAP call are written in the log in plaintext.

that's a major security flaw.

here is the excerpt from the nginx log

2020/01/20 06:00:04 [error] 29188#29188: *4957786 FastCGI sent in stderr: "PHP message: [mantisconnect.php] Error Type: SYSTEM WARNING,
Error Description: is_writable(): open_basedir restriction in effect. File(/our/logfile.log) is not within the allowed path(s): (/home/mantis_installation:/another/path/)
Stack Trace:
logging_api.php L113 is_writable(<string>'/our/logfile.log')
mc_issue_api.php L83 log_event(<integer>64, <string>'getting details for issue \'2379\'')
UnknownFile L? mc_issue_get(<string>'soap-user', <string>'user-password', <integer>2379)
mantisconnect.php L89 handle()" while reading response header from upstream, client: 91.205.36.179, server: our-mantis-server, request: "POST /our-mantis/api/soap/mantisconnect.php HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm-ais_mantis.sock:", host: "www.our-mantis-host.x"