Multi-play a GM system sensitive information leaks

The first is the SVN leak,

Http://qa.tank.duowan.com/manage/.svn/entries

But found that SVN can not see any files, but the approximate directory, direct access to the long-exposed source code http://qa.tank.duowan.com/manage/sql/dbcfg.py

HOST = ' 127.0.0.1 '

USER = ' Tkgame '

Pawd = ' Tkgame '

PORT = 0

DBNAME = ' Tkt_manage '

#

Executetype = ' Update '

BuildSQL = ' Table_defines.sql '

Updatelog = ' Update.ini '

UPDATETABLE = ' _db_update_log '

Buildupdatesql = ' _db_update_log.sql '

Backupsqlprefix = ' Bk_ '

Http://qa.tank.duowan.com/manage/sql/table_defines.sql

INSERT into ' user ' (' user_id ', ' user_name ', ' user_password ', ' user_level ', ' user_created ') VALUES

(1, ' sixcube ', ' 6511383c766f89361b27f1d0d4f25956 ', 2, 1338946866);

http://qa.tank.duowan.com/manage/i18n/config.sh

Root_path=/var/www/wwwroot/tkt/manage

I18n_path= $ROOT _path/i18n

I18n_domain=tkt_manage

Lang_list= ('/usr/bin/php-q getlanglist.php ');

len_of_lang_list=${#LANG_LIST [@]}

The first is the SVN leak,

Http://qa.tank.duowan.com/manage/.svn/entries

But found that SVN can not see any files, but the approximate directory, direct access to the long-exposed source code http://qa.tank.duowan.com/manage/sql/dbcfg.py

HOST = ' 127.0.0.1 '

USER = ' Tkgame '

Pawd = ' Tkgame '

PORT = 0

DBNAME = ' Tkt_manage '

#

Executetype = ' Update '

BuildSQL = ' Table_defines.sql '

Updatelog = ' Update.ini '

UPDATETABLE = ' _db_update_log '

Buildupdatesql = ' _db_update_log.sql '

Backupsqlprefix = ' Bk_ '

Proof of vulnerability:

Http://qa.tank.duowan.com/manage/sql/table_defines.sql

INSERT into ' user ' (' user_id ', ' user_name ', ' user_password ', ' user_level ', ' user_created ') VALUES

(1, ' sixcube ', ' 6511383c766f89361b27f1d0d4f25956 ', 2, 1338946866);

http://qa.tank.duowan.com/manage/i18n/config.sh

Root_path=/var/www/wwwroot/tkt/manage

I18n_path= $ROOT _path/i18n

I18n_domain=tkt_manage

Lang_list= ('/usr/bin/php-q getlanglist.php ');

len_of_lang_list=${#LANG_LIST [@]}

