fix(security): hide env details when debug is disabled.

- fixes  #5710

vcsserver/remote/git_remote.py

@@ -39,6 +39,7 b' from dulwich.errors import ('
 from dulwich.repo import Repo as DulwichRepo
 from dulwich.server import update_server_info
 
+import rhodecode
 from vcsserver import exceptions, settings, subprocessio
 from vcsserver.str_utils import safe_str, safe_int, safe_bytes, ascii_bytes
 from vcsserver.base import RepoFactory, obfuscate_qs, ArchiveNode, store_archive_in_cache, BytesEnvelope, BinaryEnvelope
@@ -1367,6 +1368,7 b' class GitRemote(RemoteBase):'
     @reraise_safe_exceptions
     def run_git_command(self, wire, cmd, **opts):
         path = wire.get('path', None)
+        debug_mode = rhodecode.ConfigGet().get_bool('debug')
 
         if path and os.path.isdir(path):
             opts['cwd'] = path
@@ -1405,10 +1407,14 b' class GitRemote(RemoteBase):'
             return b''.join(proc), b''.join(proc.stderr)
         except OSError as err:
             cmd = ' '.join(map(safe_str, cmd))  # human friendly CMD
-            tb_err = ("Couldn't run git command (%s).\n"
-                      "Original error was:%s\n"
-                      "Call options:%s\n"
-                      % (cmd, err, _opts))
+            call_opts = {}
+            if debug_mode:
+                call_opts = _opts
+
+            tb_err = ("Couldn't run git command ({}).\n"
+                      "Original error was:{}\n"
+                      "Call options:{}\n"
+                      .format(cmd, err, call_opts))
             log.exception(tb_err)
             if safe_call:
                 return '', err

vcsserver/remote/svn_remote.py

@@ -36,6 +36,7 b' import svn.diff # noqa'
 import svn.fs  # noqa
 import svn.repos  # noqa
 
+import rhodecode
 from vcsserver import svn_diff, exceptions, subprocessio, settings
 from vcsserver.base import (
     RepoFactory,
@@ -552,6 +553,7 b' class SvnRemote(RemoteBase):'
     @reraise_safe_exceptions
     def run_svn_command(self, wire, cmd, **opts):
         path = wire.get('path', None)
+        debug_mode = rhodecode.ConfigGet().get_bool('debug')
 
         if path and os.path.isdir(path):
             opts['cwd'] = path
@@ -573,10 +575,14 b' class SvnRemote(RemoteBase):'
                 return '', safe_str(err).strip()
             else:
                 cmd = ' '.join(map(safe_str, cmd))  # human friendly CMD
-                tb_err = ("Couldn't run svn command (%s).\n"
-                          "Original error was:%s\n"
-                          "Call options:%s\n"
-                          % (cmd, err, _opts))
+                call_opts = {}
+                if debug_mode:
+                    call_opts = _opts
+
+                tb_err = ("Couldn't run svn command ({}).\n"
+                          "Original error was:{}\n"
+                          "Call options:{}\n"
+                          .format(cmd, err, call_opts))
                 log.exception(tb_err)
                 raise exceptions.VcsException()(tb_err)