FaceBook源代码泄漏（预防PHP源代码泄漏的方法）

╰半橙微兮° 2022-09-19 05:26 195阅读 0赞

## FaceBook源代码泄漏 ##

据 [TechCrunch][]的消息称，FaceBook源代码遭到泄漏，并且已经被发布到名叫 [Facebook Secrets][] 博客。一般而言，源代码泄漏发生存在两种情况：其一是内部源代码开发者泄漏，另外一种就是利用程序的漏洞从而获取源代码。

登录该博客我们可以看到只是简单的几行代码，虽然不十分确定这就是FaceBook的源代码，然而让人担心的是成千上万用户的私人资料是否也安全呢？这对于Facebook来说无疑是致命的一击！

下面是该博客站点贴出的FaceBook首页源代码。

![None.gif][]  1 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /html/init.php ' ;  
![None.gif][] 2 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/home.php ' ;  
![None.gif][] 3 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/requests.php ' ;  
![None.gif][] 4 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/feed/newsfeed.php ' ;  
![None.gif][] 5 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/poke.php ' ;  
![None.gif][] 6 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/share.php ' ;  
![None.gif][] 7 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/orientation.php ' ;  
![None.gif][] 8 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/feed/newsfeed.php ' ;  
![None.gif][] 9 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/mobile/register.php ' ;  
![None.gif][] 10 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/forms\_lib.php ' ;  
![None.gif][] 11 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/contact\_importer/contact\_importer.php ' ;  
![None.gif][] 12 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/feed/util.php ' ;  
![None.gif][] 13 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/hiding\_prefs.php ' ;  
![None.gif][] 14 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/abtesting.php ' ;  
![None.gif][] 15 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/friends.php ' ;  
![None.gif][] 16 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/statusupdates.php ' ;  
![None.gif][] 17 .   
![None.gif][] 18 .  //  lib/display/feed.php has to be declared here for scope issues.    
![None.gif][]  19 .  //  This keeps display/feed.php cleaner and easier to understand.    
![None.gif][]  20 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/display/feed.php ' ;  
![None.gif][] 21 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/monetization\_box.php ' ;  
![None.gif][] 22 .   
![None.gif][] 23 .  //  require login    
![None.gif][]  24 .  $user  =  require\_login();  
![None.gif][] 25 .  print\_time( ' require\_login ' );  
![None.gif][] 26 .  param\_request( array (  ' react '  =>  $PARAM\_EXISTS ));  
![None.gif][] 27 .   
![None.gif][] 28 .  //  Check and fix broken emails    
![None.gif][]  29 .  //  LN - disabling due to excessive can\_see dirties and sets when enabled.    
![None.gif][]  30 .  // check\_and\_fix\_broken\_emails($user);    
![None.gif][]  31 .   
![None.gif][] 32 .  //  migrate AIM screenname from profile to screenname table if needed    
![None.gif][]  33 .  migrate\_screenname ( $user );  
![None.gif][] 34 .   
![None.gif][] 35 .  //  homepage announcement variables    
![None.gif][]  36 .  $HIDE\_ANNOUNCEMENT\_BIT  =  get\_site\_variable( ' HIDE\_ANNOUNCEMENT\_BIT ' );  
![None.gif][] 37 .  $HIDE\_INTRO\_BITMASK  =  get\_site\_variable( ' HIDE\_INTRO\_BITMASK ' );  
![None.gif][] 38 .   
![None.gif][] 39 .  //  redirects    
![None.gif][]  40 .  if  (is\_sponsor\_user()) \{  
![None.gif][] 41 .  redirect( ' bizhome.php ' ,  ' www ' );  
![None.gif][] 42 .  \}  
![None.gif][] 43 .   
![None.gif][] 44 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/mesg.php ' ;  
![None.gif][] 45 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/invitetool.php ' ;  
![None.gif][] 46 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/grammar.php ' ;  
![None.gif][] 47 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/securityq.php ' ;  
![None.gif][] 48 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/events.php ' ;  
![None.gif][] 49 .  include\_once  $\_SERVER \[ ' PHP\_ROOT ' \] . ' /lib/rooster/stories.php ' ;  
![None.gif][] 50 .   
![None.gif][] 51 .  //  todo: password confirmation redirects here (from html/reset.php),    
![None.gif][]  52 .  //  do we want a confirmation message?    
![None.gif][]  53 .   
![None.gif][] 54 .  param\_get\_slashed( array (  
![None.gif][] 55 .  ' feeduser '  =>  $PARAM\_INT ,  // debug: gets feed for user here    
![None.gif][]  56 .  ' err '  =>  $PARAM\_STRING ,  //  returning from a failed entry on an orientation form    
![None.gif][]  57 .  ' error '  =>  $PARAM\_STRING ,  //  an error can also be here because the profile photo upload code is crazy    
![None.gif][]  58 .  ' ret '  =>  $PARAM\_INT ,   
![None.gif][] 59 .  ' success '  =>  $PARAM\_INT ,  //  successful profile picture upload    
![None.gif][]  60 .  ' jn '  =>  $PARAM\_INT ,  //  joined a network for orientation    
![None.gif][]  61 .  ' np '  =>  $PARAM\_INT ,  //  network pending (for work/address network)    
![None.gif][]  62 .  ' me '  =>  $PARAM\_STRING ,  //  mobile error    
![None.gif][]  63 .  ' mr '  =>  $PARAM\_EXISTS ,  //  force mobile reg view    
![None.gif][]  64 .  ' mobile '  =>  $PARAM\_EXISTS ,  //  mobile confirmation code sent    
![None.gif][]  65 .  ' jif '  =>  $PARAM\_EXISTS ,  //  just imported friends    
![None.gif][]  66 .  ' ied '  =>  $PARAM\_STRING ,  //  import email domain    
![None.gif][]  67 .  ' o '  =>  $PARAM\_EXISTS ,  //  first time orientation, passed on confirm    
![None.gif][]  68 .  ' verified '  =>  $PARAM\_EXISTS ));  //  verified mobile phone    
![None.gif][]  69 .   
![None.gif][] 70 .  param\_post( array (  
![None.gif][] 71 .  ' leave\_orientation '  =>  $PARAM\_EXISTS ,   
![None.gif][] 72 .  ' show\_orientation '  =>  $PARAM\_INT ,  //  show an orientation step    
![None.gif][]  73 .  ' hide\_orientation '  =>  $PARAM\_INT ));  //  skip an orientation step    
![None.gif][]  74 .   
![None.gif][] 75 .  //  homepage actions    
![None.gif][]  76 .  if  ( $req\_react  &&  validate\_expiring\_hash( $req\_react ,  $GLOBALS \[ ' url\_md5key ' \])) \{  
![None.gif][] 77 .  $show\_reactivated\_message  =  true ;  
![None.gif][] 78 .  \}  else  \{  
![None.gif][] 79 .  $show\_reactivated\_message  =  false ;  
![None.gif][] 80 .  \}  
![None.gif][] 81 .  tpl\_set( ' show\_reactivated\_message ' ,  $show\_reactivated\_message );  
![None.gif][] 82 .   
![None.gif][] 83 .   
![None.gif][] 84 .  //  upcoming events    
![None.gif][]  85 .  events\_check\_future\_events( $user );  //  make sure big tunas haven't moved around    
![None.gif][]  86 .  $upcoming\_events  =  events\_get\_imminent\_for\_user( $user );  
![None.gif][] 87 .   
![None.gif][] 88 .  //  this is all stuff that can be fetched together!    
![None.gif][]  89 .  $upcoming\_events\_short  =  array ();  
![None.gif][] 90 .  obj\_multiget\_short( array\_keys ( $upcoming\_events ) ,  true ,  $upcoming\_events\_short );  
![None.gif][] 91 .  $new\_pokes  =  0 ;  
![None.gif][] 92 .  // only get the next N pokes for display    
![None.gif][]  93 .  // where N is set in the dbget to avoid caching issues    
![None.gif][]  94 .  $poke\_stats  =  get\_num\_pokes( $user );  
![None.gif][] 95 .  get\_next\_pokes( $user ,  true ,  $new\_pokes );  
![None.gif][] 96 .  $poke\_count  =  $poke\_stats \[ ' unseen ' \];  
![None.gif][] 97 .   
![None.gif][] 98 .  $targeted\_data  =  array ();  
![None.gif][] 99 .  home\_get\_cache\_targeted\_data( $user ,  true ,  $targeted\_data );  
![None.gif][] 100 .  $announcement\_data  =  array ();  
![None.gif][] 101 .  home\_get\_cache\_announcement\_data( $user ,  true ,  $announcement\_data );  
![None.gif][] 102 .  $orientation  =  0 ;  
![None.gif][] 103 .  orientation\_get\_status( $user ,  true ,  $orientation );  
![None.gif][] 104 .  $short\_profile  =  array ();  
![None.gif][] 105 .  profile\_get\_short( $user ,  true ,  $short\_profile );  
![None.gif][] 106 .  //  pure priming stuff    
![None.gif][]  107 .  privacy\_get\_network\_settings( $user ,  true );  
![None.gif][] 108 .  $presence  =  array ();  
![None.gif][] 109 .  mobile\_get\_presence\_data( $user ,  true ,  $presence );  
![None.gif][] 110 .  feedback\_get\_event\_weights( $user ,  true );  
![None.gif][] 111 .  //  Determine if we want to display the feed intro message    
![None.gif][]  112 .  $intro\_settings  =  0 ;  
![None.gif][] 113 .  user\_get\_hide\_intro\_bitmask( $user ,  true ,  $intro\_settings );  
![None.gif][] 114 .  $user\_friend\_finder  =  true ;  
![None.gif][] 115 .  contact\_importer\_get\_used\_friend\_finder( $user ,  true ,  $used\_friend\_finder );  
![None.gif][] 116 .  $all\_requests  =  requests\_get\_cache\_data( $user );  
![None.gif][] 117 .  //  FIXME?: is it sub-optimal to call this both in requests\_get\_cache\_data and here?    
![None.gif][]  118 .  $friends\_status  =  statusupdates\_get\_recent( $user ,  null ,  3 );  
![None.gif][] 119 .  memcache\_dispatch();  //  populate cache data    
![None.gif][]  120 .   
![None.gif][] 121 .  //  Merman's Admin profile always links to the Merman's home    
![None.gif][]  122 .  if  (user\_has\_obj\_attached( $user )) \{  
![None.gif][] 123 .  redirect( ' mhome.php ' ,  ' www ' );  
![None.gif][] 124 .  \}  
![None.gif][] 125 .   
![None.gif][] 126 .  if  ( is\_array ( $upcoming\_events )) \{  
![None.gif][] 127 .  foreach  ( $upcoming\_events  as  $event\_id  =>  $data ) \{  
![None.gif][] 128 .  $upcoming\_events \[ $event\_id \]\[ ' name ' \]  =  txt\_set( $upcoming\_events\_short \[ $event\_id \]\[ ' name ' \]);  
![None.gif][] 129 .  \}  
![None.gif][] 130 .  \}  
![None.gif][] 131 .   
![None.gif][] 132 .  tpl\_set( ' upcoming\_events '  ,  $upcoming\_events );  
![None.gif][] 133 .   
![None.gif][] 134 .  //  disabled account actions    
![None.gif][]  135 .  $disabled\_warning  =  ((IS\_DEV\_SITE  ||  IS\_QA\_SITE)  &&  is\_disabled\_user( $user ));  
![None.gif][] 136 .  tpl\_set( ' disabled\_warning ' ,  $disabled\_warning );  
![None.gif][] 137 .   
![None.gif][] 138 .  //  new pokes (no more messages here, they are in the top nav!)    
![None.gif][]  139 .  if  ( ! user\_is\_guest( $user )) \{  
![None.gif][] 140 .  tpl\_set( ' poke\_count '  ,  $poke\_count );  
![None.gif][] 141 .  tpl\_set( ' pokes '  ,  $new\_pokes );  
![None.gif][] 142 .  \}  
![None.gif][] 143 .   
![None.gif][] 144 .  //  get announcement computations    
![None.gif][]  145 .  tpl\_set( ' targeted\_data '  ,  $targeted\_data );  
![None.gif][] 146 .  tpl\_set( ' announcement\_data '  ,  $announcement\_data );  
![None.gif][] 147 .   
![None.gif][] 148 .   
![None.gif][] 149 .  //  birthday notifications    
![None.gif][]  150 .  tpl\_set( ' birthdays '  ,  $birthdays  =  user\_get\_birthday\_notifications( $user ,  $short\_profile ));  
![None.gif][] 151 .  tpl\_set( ' show\_birthdays '  ,  $show\_birthdays  =  ( count ( $birthdays )  ||  ! $orientation ));  
![None.gif][] 152 .   
![None.gif][] 153 .  //  user info    
![None.gif][]  154 .  tpl\_set( ' first\_name '  ,  user\_get\_first\_name(txt\_set( $short\_profile \[ ' id ' \])));  
![None.gif][] 155 .  tpl\_set( ' user '  ,  $user );  
![None.gif][] 156 .   
![None.gif][] 157 .  //  decide if there are now any requests to show    
![None.gif][]  158 .  $show\_requests  =  false ;  
![None.gif][] 159 .  foreach  ( $all\_requests  as  $request\_category ) \{  
![None.gif][] 160 .  if  ( $request\_category ) \{  
![None.gif][] 161 .  $show\_requests  =  true ;  
![None.gif][] 162 .  break ;  
![None.gif][] 163 .  \}  
![None.gif][] 164 .  \}  
![None.gif][] 165 .  tpl\_set( ' all\_requests ' ,  $show\_requests  ?  $all\_requests  :  null );  
![None.gif][] 166 .   
![None.gif][] 167 .  $permissions  =  privacy\_get\_reduced\_network\_permissions( $user ,  $user );  
![None.gif][] 168 .   
![None.gif][] 169 .  //  status    
![None.gif][]  170 .  $user\_info  =  array ( ' user '  =>  $user ,   
![None.gif][] 171 .  ' firstname '  =>  user\_get\_first\_name( $user ) ,   
![None.gif][] 172 .  ' see\_all '  =>  ' /statusupdates/?ref=hp ' ,   
![None.gif][] 173 .  ' profile\_pic '  =>  make\_profile\_image\_src\_direct( $user ,  ' thumb ' ) ,   
![None.gif][] 174 .  ' square\_pic '  =>  make\_profile\_image\_src\_direct( $user ,  ' square ' ));  
![None.gif][] 175 .   
![None.gif][] 176 .  if  ( ! empty ( $presence )  &&  $presence \[ ' status\_time ' \]  >  ( time ()  \-  60 \* 60 \* 24 \* 7 )) \{  
![None.gif][] 177 .  $status  =  array ( ' message '  =>  txt\_set( $presence \[ ' status ' \]) ,   
![None.gif][] 178 .  ' time '  =>  $presence \[ ' status\_time ' \] ,   
![None.gif][] 179 .  ' source '  =>  $presence \[ ' status\_source ' \]);  
![None.gif][] 180 .  \}  else  \{  
![None.gif][] 181 .  $status  =  array ( ' message '  =>  null ,  ' time '  =>  null ,  ' source '  =>  null );  
![None.gif][] 182 .  \}  
![None.gif][] 183 .  tpl\_set( ' user\_info ' ,  $user\_info );  
![None.gif][] 184 .   
![None.gif][] 185 .  tpl\_set( ' show\_status ' ,  $show\_status  =  ! $orientation );  
![None.gif][] 186 .  tpl\_set( ' status ' ,  $status );  
![None.gif][] 187 .  tpl\_set( ' status\_custom ' ,  $status\_custom  =  mobile\_get\_status\_custom( $user ));  
![None.gif][] 188 .  tpl\_set( ' friends\_status ' ,  $friends\_status );  
![None.gif][] 189 .   
![None.gif][] 190 .  //  orientation    
![None.gif][]  191 .  if  ( $orientation ) \{  
![None.gif][] 192 .  if  ( $post\_leave\_orientation ) \{  
![None.gif][] 193 .  orientation\_update\_status( $user ,  $orientation ,  2 );  
![None.gif][] 194 .  notification\_notify\_exit\_orientation( $user );  
![None.gif][] 195 .  dirty\_user( $user );  
![None.gif][] 196 .  redirect( ' home.php ' );  
![None.gif][] 197 .  \}  else  if  (orientation\_eligible\_exit( array ( ' uid ' => $user ))  ==  2 ) \{  
![None.gif][] 198 .  orientation\_update\_status( $user ,  $orientation ,  1 );  
![None.gif][] 199 .  notification\_notify\_exit\_orientation( $user );  
![None.gif][] 200 .  dirty\_user( $user );  
![None.gif][] 201 .  redirect( ' home.php ' );  
![None.gif][] 202 .  \}  
![None.gif][] 203 .  \}  
![None.gif][] 204 .   
![None.gif][] 205 .  //  timezone - outside of stealth, update user's timezone if necessary    
![None.gif][]  206 .  $set\_time  =  ! user\_is\_alpha( $user ,  ' stealth ' );  
![None.gif][] 207 .  tpl\_set( ' timezone\_autoset ' ,  $set\_time  );  
![None.gif][] 208 .  if  ( $set\_time ) \{  
![None.gif][] 209 .  $daylight\_savings  =  get\_site\_variable( ' DAYLIGHT\_SAVINGS\_ON ' );  
![None.gif][] 210 .  tpl\_set( ' timezone ' ,  $short\_profile \[ ' timezone ' \]  \-  ( $daylight\_savings  ?  4  :  5 ) );  
![None.gif][] 211 .  \}  
![None.gif][] 212 .   
![None.gif][] 213 .  //  set next step if we can    
![None.gif][]  214 .  if  ( ! $orientation ) \{  
![None.gif][] 215 .  user\_set\_next\_step( $user ,  $short\_profile );  
![None.gif][] 216 .  \}  
![None.gif][] 217 .   
![None.gif][] 218 .  //  note: don't make this an else with the above statement, because then no news feed stories will be fetched if they're exiting orientation    
![None.gif][]  219 .  if  ( $orientation ) \{  
![None.gif][] 220 .  extract (orientation\_get\_const());  
![None.gif][] 221 .   
![None.gif][] 222 .  require\_js( ' js/dynamic\_dialog.js ' );  
![None.gif][] 223 .  require\_js( ' js/suggest.js ' );  
![None.gif][] 224 .  require\_js( ' js/typeahead\_ns.js ' );  
![None.gif][] 225 .  require\_js( ' js/suggest.js ' );  
![None.gif][] 226 .  require\_js( ' js/editregion.js ' );  
![None.gif][] 227 .  require\_js( ' js/orientation.js ' );  
![None.gif][] 228 .  require\_css( ' css/typeahead.css ' );  
![None.gif][] 229 .  require\_css( ' css/editor.css ' );  
![None.gif][] 230 .   
![None.gif][] 231 .  if  ( $post\_hide\_orientation  &&  $post\_hide\_orientation  <=  $ORIENTATION\_MAX ) \{  
![None.gif][] 232 .  $orientation \[ ' orientation\_bitmask ' \]  |=  ( $post\_hide\_orientation  \*  $ORIENTATION\_SKIPPED\_MODIFIER );  
![None.gif][] 233 .  orientation\_update\_status( $user ,  $orientation );  
![None.gif][] 234 .  \}  else  if  ( $post\_show\_orientation  &&  $post\_show\_orientation  <=  $ORIENTATION\_MAX ) \{  
![None.gif][] 235 .  $orientation \[ ' orientation\_bitmask ' \]  &=  ~ ( $post\_show\_orientation  \*  $ORIENTATION\_SKIPPED\_MODIFIER );  
![None.gif][] 236 .  orientation\_update\_status( $user ,  $orientation );  
![None.gif][] 237 .  \}  
![None.gif][] 238 .   
![None.gif][] 239 .  $stories  =  orientation\_get\_stories( $user ,  $orientation );  
![None.gif][] 240 .  switch  ( $get\_err ) \{  
![None.gif][] 241 .  case  $ORIENTATION\_ERR\_COLLEGE :   
![None.gif][] 242 .  $temp  =  array ();  //  the affil\_retval\_msg needs some parameters won't be used    
![None.gif][]  243 .  $stories \[ $ORIENTATION\_NETWORK \]\[ ' failed\_college ' \] = affil\_retval\_msg( $get\_ret ,  $temp ,  $temp );  
![None.gif][] 244 .  break ;  
![None.gif][] 245 .  case  $ORIENTATION\_ERR\_CORP :   
![None.gif][] 246 .  $temp  =  array ();  
![None.gif][] 247 .  //  We special case the network not recognized error here, because affil\_retval\_msg is retarded.    
![None.gif][]  248 .  $stories \[ $ORIENTATION\_NETWORK \]\[ ' failed\_corp ' \]  =  ( $get\_ret  ==  70 )  ?  ' The email you entered did not match any of our supported networks.  '  .   
![None.gif][] 249 .  ' Click here to see our supported list.  '  .   
![None.gif][] 250 .  ' Go here to suggest your network for the future. '   
![None.gif][] 251 .  :  affil\_retval\_msg( $get\_ret ,  $temp ,  $temp );  
![None.gif][] 252 .  break ;  
![None.gif][] 253 .  \}  
![None.gif][] 254 .   
![None.gif][] 255 .  //  photo upload error    
![None.gif][]  256 .  if  ( $get\_error ) \{  
![None.gif][] 257 .  $stories \[ $ORIENTATION\_ORDER \[ $ORIENTATION\_PROFILE \]\]\[ ' upload\_error ' \]  =  pic\_get\_error\_text( $get\_error );  
![None.gif][] 258 .  \}  
![None.gif][] 259 .  //  photo upload success    
![None.gif][]  260 .  else  if  ( $get\_success  ==  1 ) \{  
![None.gif][] 261 .  $stories \[ $ORIENTATION\_ORDER \[ $ORIENTATION\_PROFILE \]\]\[ ' uploaded\_pic ' \]  =  true ;  
![None.gif][] 262 .  //  join network success    
![None.gif][]  263 .  \}  else  if  ( $get\_jn ) \{  
![None.gif][] 264 .  $stories \[ $ORIENTATION\_ORDER \[ $ORIENTATION\_NETWORK \]\]\[ ' joined ' \]  =  array (  
![None.gif][] 265 .  ' id '  =>  $get\_jn ,   
![None.gif][] 266 .  ' name '  =>  network\_get\_name( $get\_jn ));  
![None.gif][] 267 .  //  network join pending    
![None.gif][]  268 .  \}  else  if  ( $get\_np ) \{  
![None.gif][] 269 .   
![None.gif][] 270 .  $stories \[ $ORIENTATION\_ORDER \[ $ORIENTATION\_NETWORK \]\]\[ ' join\_pending ' \]  =  array (  
![None.gif][] 271 .  ' id '  =>  $get\_np ,   
![None.gif][] 272 .  ' email '  =>  get\_affil\_email\_conf( $user ,  $get\_np ) ,   
![None.gif][] 273 .  ' network '  =>  network\_get\_name( $get\_np ));  
![None.gif][] 274 .  //  just imported friend confirmation    
![None.gif][]  275 .  \}  else  if  ( $get\_jif ) \{  
![None.gif][] 276 .  $stories \[ $ORIENTATION\_ORDER \[ $ORIENTATION\_NETWORK \]\]\[ ' just\_imported\_friends ' \]  =  true ;  
![None.gif][] 277 .  $stories \[ $ORIENTATION\_ORDER \[ $ORIENTATION\_NETWORK \]\]\[ ' domain ' \]  =  $get\_ied ;  
![None.gif][] 278 .  \}  
![None.gif][] 279 .   
![None.gif][] 280 .  //  Mobile web API params    
![None.gif][]  281 .  if  ( $get\_mobile ) \{  
![None.gif][] 282 .  $stories \[ $ORIENTATION\_ORDER \[ $ORIENTATION\_MOBILE \]\]\[ ' sent\_code ' \]  =  true ;  
![None.gif][] 283 .  $stories \[ $ORIENTATION\_ORDER \[ $ORIENTATION\_MOBILE \]\]\[ ' view ' \]  =  ' confirm ' ;  
![None.gif][] 284 .  \}  
![None.gif][] 285 .  if  ( $get\_verified ) \{  
![None.gif][] 286 .  $stories \[ $ORIENTATION\_ORDER \[ $ORIENTATION\_MOBILE \]\]\[ ' verified ' \]  =  true ;  
![None.gif][] 287 .  \}  
![None.gif][] 288 .  if  ( $get\_me ) \{  
![None.gif][] 289 .  $stories \[ $ORIENTATION\_ORDER \[ $ORIENTATION\_MOBILE \]\]\[ ' error ' \]  =  $get\_me ;  
![None.gif][] 290 .  \}  
![None.gif][] 291 .  if  ( $get\_mr ) \{  
![None.gif][] 292 .  $stories \[ $ORIENTATION\_ORDER \[ $ORIENTATION\_MOBILE \]\]\[ ' view ' \]  =  ' register ' ;  
![None.gif][] 293 .  \}  
![None.gif][] 294 .   
![None.gif][] 295 .  if  (orientation\_eligible\_exit( $orientation )) \{  
![None.gif][] 296 .  tpl\_set( ' orientation\_show\_exit ' ,  true );  
![None.gif][] 297 .  \}  
![None.gif][] 298 .  tpl\_set( ' orientation\_stories ' ,  $stories );  
![None.gif][] 299 .   
![None.gif][] 300 .  // if in orientation, we hide all feed intros (all 1's in bitmask)    
![None.gif][]  301 .  $intro\_settings  =  \- 1 ;  
![None.gif][] 302 .   
![None.gif][] 303 .  \}  
![None.gif][] 304 .  tpl\_set( ' orientation ' ,  $orientation );  
![None.gif][] 305 .   
![None.gif][] 306 .  //  Rooster Stories    
![None.gif][]  307 .  if  ( ! $orientation  &&   
![None.gif][] 308 .  ((get\_site\_variable( ' ROOSTER\_ENABLED ' )  ==  2 )  ||   
![None.gif][] 309 .  (get\_site\_variable( ' ROOSTER\_DEV\_ENABLED ' )  ==  2 ))) \{  
![None.gif][] 310 .  $rooster\_story\_count  =  get\_site\_variable( ' ROOSTER\_STORY\_COUNT ' );  
![None.gif][] 311 .  if  ( ! isset ( $rooster\_story\_count )) \{  
![None.gif][] 312 .  //  Set default if something is wrong with the sitevar    
![None.gif][]  313 .  $rooster\_story\_count  =  2 ;  
![None.gif][] 314 .  \}  
![None.gif][] 315 .  $rooster\_stories  =  rooster\_get\_stories( $user ,  $rooster\_story\_count ,  $log\_omissions  =  true );  
![None.gif][] 316 .  if  ( ! emptyempty( $rooster\_stories )  &&  ! emptyempty( $rooster\_stories \[ ' stories ' \])) \{  
![None.gif][] 317 .  //  Do page-view level logging here    
![None.gif][]  318 .  foreach ( $rooster\_stories \[ ' stories ' \]  as  $story ) \{  
![None.gif][] 319 .  rooster\_log\_action( $user ,  $story ,  ROOSTER\_LOG\_ACTION\_VIEW);  
![None.gif][] 320 .  \}  
![None.gif][] 321 .  tpl\_set( ' rooster\_stories ' ,  $rooster\_stories );  
![None.gif][] 322 .  \}  
![None.gif][] 323 .  \}  
![None.gif][] 324 .   
![None.gif][] 325 .  //  set the variables for the home announcement code    
![None.gif][]  326 .  $hide\_announcement\_tpl  =  ( $intro\_settings  |  $HIDE\_INTRO\_BITMASK )  &  $HIDE\_ANNOUNCEMENT\_BIT ;  
![None.gif][] 327 .  //  if on qa/dev site, special rules    
![None.gif][]  328 .  $HIDE\_INTRO\_ON\_DEV  =  get\_site\_variable( ' HIDE\_INTRO\_ON\_DEV ' );  
![None.gif][] 329 .  if  ((IS\_QA\_SITE  ||  IS\_DEV\_SITE)  &&  ! $HIDE\_INTRO\_ON\_DEV ) \{  
![None.gif][] 330 .  $hide\_announcement\_tpl  =  0 ;  
![None.gif][] 331 .  \}  
![None.gif][] 332 .   
![None.gif][] 333 .  tpl\_set( ' hide\_announcement ' ,  $hide\_announcement\_tpl );  
![None.gif][] 334 .  if ( $is\_candidate  =  is\_candidate\_user( $user )) \{  
![None.gif][] 335 .  tpl\_set( ' hide\_announcement ' ,  false );  
![None.gif][] 336 .  \}  
![None.gif][] 337 .  $home\_announcement\_tpl  =  ! $hide\_announcement\_tpl  ||  $is\_candidate  ?  home\_get\_announcement\_info( $user )  :  0 ;  
![None.gif][] 338 .  tpl\_set( ' home\_announcement ' ,  $home\_announcement\_tpl );  
![None.gif][] 339 .  tpl\_set( ' hide\_announcement\_bit ' ,  $HIDE\_ANNOUNCEMENT\_BIT );  
![None.gif][] 340 .   
![None.gif][] 341 .  $show\_friend\_finder  =  ! $orientation  &&  contact\_importer\_enabled( $user )  &&  ! user\_get\_hiding\_pref( $user ,  ' home\_friend\_finder ' );  
![None.gif][] 342 .  tpl\_set( ' show\_friend\_finder ' ,  $show\_friend\_finder );  
![None.gif][] 343 .  if  ( $show\_friend\_finder  &&  (user\_get\_friend\_count( $user )  >  20 )) \{  
![None.gif][] 344 .  tpl\_set( ' friend\_finder\_hide\_options ' ,  array ( ' text ' => ' close ' ,   
![None.gif][] 345 .  ' onclick ' => " return clearFriendFinder() " ));  
![None.gif][] 346 .  \}  else  \{  
![None.gif][] 347 .  tpl\_set( ' friend\_finder\_hide\_options ' ,  null );  
![None.gif][] 348 .  \}  
![None.gif][] 349 .   
![None.gif][] 350 .  $account\_info  =  user\_get\_account\_info( $user );  
![None.gif][] 351 .  $account\_create\_time  =  $account\_info \[ ' time ' \];  
![None.gif][] 352 .   
![None.gif][] 353 .  tpl\_set( ' show\_friend\_finder\_top ' ,   
![None.gif][] 354 .  ! $used\_friend\_finder );  
![None.gif][] 355 .   
![None.gif][] 356 .  tpl\_set( ' user ' ,  $user );  
![None.gif][] 357 .   
![None.gif][] 358 .   
![None.gif][] 359 .  //  MONETIZATION BOX    
![None.gif][]  360 .  $minimize\_monetization\_box  =  user\_get\_hiding\_pref( $user ,  ' home\_monetization ' );  
![None.gif][] 361 .  $show\_monetization\_box  =  ( ! $orientation  &&   
![None.gif][] 362 .  get\_site\_variable( ' HOMEPAGE\_MONETIZATION\_BOX ' ));  
![None.gif][] 363 .  tpl\_set( ' show\_monetization\_box ' ,  $show\_monetization\_box );  
![None.gif][] 364 .  tpl\_set( ' minimize\_monetization\_box ' ,  $minimize\_monetization\_box );  
![None.gif][] 365 .   
![None.gif][] 366 .  if  ( $show\_monetization\_box ) \{  
![None.gif][] 367 .  $monetization\_box\_data  =  monetization\_box\_user\_get\_data( $user );  
![None.gif][] 368 .  txt\_set( ' monetization\_box\_data ' ,  $monetization\_box\_data );  
![None.gif][] 369 .  \}  
![None.gif][] 370 .   
![None.gif][] 371 .   
![None.gif][] 372 .  //  ORIENTATION    
![None.gif][]  373 .  if  ( $orientation ) \{  
![None.gif][] 374 .  $network\_ids  =  id\_get\_networks( $user );  
![None.gif][] 375 .  $network\_names  =  multiget\_network\_name( $network\_ids );  
![None.gif][] 376 .  $in\_corp\_network  =  in\_array ( $GLOBALS \[ ' TYPE\_CORP ' \] ,  array\_map ( ' extract\_network\_type ' ,  $network\_ids ));  
![None.gif][] 377 .  $show\_corp\_search  =  $in\_corp\_network  ||   
![None.gif][] 378 .  get\_age(user\_get\_basic\_info\_attr( $user ,  ' birthday ' ))  >=  21 ;  
![None.gif][] 379 .  $pending\_hs  =  is\_hs\_pending\_user( $user );  
![None.gif][] 380 .  $hs\_id  =  null ;  
![None.gif][] 381 .  $hs\_name  =  null ;  
![None.gif][] 382 .  if  ( $pending\_hs ) \{  
![None.gif][] 383 .  foreach  (id\_get\_pending\_networks( $user )  as  $network ) \{  
![None.gif][] 384 .  if  (extract\_network\_type( $network \[ ' network\_key ' \])  ==  $GLOBALS \[ ' TYPE\_HS ' \]) \{  
![None.gif][] 385 .  $hs\_id  =  $network \[ ' network\_key ' \];  
![None.gif][] 386 .  $hs\_name  =  network\_get\_name( $hs\_id );  
![None.gif][] 387 .  break ;  
![None.gif][] 388 .  \}  
![None.gif][] 389 .  \}  
![None.gif][] 390 .  \}  
![None.gif][] 391 .  // $orientation\_people = orientation\_get\_friend\_and\_inviter\_ids($user);    
![None.gif][]  392 .  $orientation\_people  =  array ( ' friends '  =>  user\_get\_all\_friends( $user ) ,   
![None.gif][] 393 .  ' pending '  =>  array\_keys (user\_get\_friend\_requests( $user )) ,   
![None.gif][] 394 .  ' inviters ' =>  array () ,  //  wc: don't show inviters for now    
![None.gif][]  395 .  );  
![None.gif][] 396 .  $orientation\_info  =  array\_merge ( $orientation\_people ,   
![None.gif][] 397 .  array ( ' network\_names '  =>  $network\_names ,   
![None.gif][] 398 .  ' show\_corp\_search '  =>  $show\_corp\_search ,   
![None.gif][] 399 .  ' pending\_hs '  =>  array ( ' hs\_id ' => $hs\_id ,   
![None.gif][] 400 .  ' hs\_name ' => $hs\_name ) ,   
![None.gif][] 401 .  ' user '  =>  $user ,   
![None.gif][] 402 .  ));  
![None.gif][] 403 .  tpl\_set( ' orientation\_info ' ,  $orientation\_info );  
![None.gif][] 404 .   
![None.gif][] 405 .  tpl\_set( ' simple\_orientation\_first\_login ' ,  $get\_o );  //  unused right now    
![None.gif][]  406 .  \}  
![None.gif][] 407 .   
![None.gif][] 408 .   
![None.gif][] 409 .  //  Roughly determine page length for ads    
![None.gif][]  410 .  //  first, try page length using right-hand panel    
![None.gif][]  411 .  $ads\_page\_length\_data  =  3  \+  //  3 for profile pic + next step    
![None.gif][]  412 .  ( $show\_friend\_finder  ?  1  :  0 )  \+   
![None.gif][] 413 .  ( $show\_status  ?  ( $status\_custom  ?  count ( $friends\_status )  :  0 )  :  0 )  \+   
![None.gif][] 414 .  ( $show\_monetization\_box  ?  1  :  0 )  \+   
![None.gif][] 415 .  ( $show\_birthdays  ?  count ( $birthdays )  :  0 )  \+   
![None.gif][] 416 .  count ( $new\_pokes );  
![None.gif][] 417 .   
![None.gif][] 418 .  //  page length using feed stories    
![None.gif][]  419 .  if  ( $orientation ) \{  
![None.gif][] 420 .  $ads\_page\_length\_data  =  max ( $ads\_page\_length\_data ,  count ( $stories )  \*  5 );  
![None.gif][] 421 .  \}  
![None.gif][] 422 .  tpl\_set( ' ads\_page\_length\_data ' ,  $ads\_page\_length\_data );  
![None.gif][] 423 .   
![None.gif][] 424 .  $feed\_stories  =  null ;  
![None.gif][] 425 .  if  ( ! $orientation ) \{  //  if they're not in orientation they get other cool stuff    
![None.gif][]  426 .  //  ad\_insert: the ad type to try to insert for the user    
![None.gif][]  427 .  //  (0 if we don't want to try an insert)    
![None.gif][]  428 .  $ad\_insert  =  get\_site\_variable( ' FEED\_ADS\_ENABLE\_INSERTS ' );  
![None.gif][] 429 .   
![None.gif][] 430 .  $feed\_off  =  false ;  
![None.gif][] 431 .   
![None.gif][] 432 .  if  (check\_super( $user )  &&  $get\_feeduser )\{  
![None.gif][] 433 .  $feed\_stories  =  user\_get\_displayable\_stories( $get\_feeduser ,  0 ,  null ,  $ad\_insert );  
![None.gif][] 434 .  \}  else  if  (can\_see( $user ,  $user ,  ' feed ' )) \{  
![None.gif][] 435 .  $feed\_stories  =  user\_get\_displayable\_stories( $user ,  0 ,  null ,  $ad\_insert );  
![None.gif][] 436 .  \}  else  \{  
![None.gif][] 437 .  $feed\_off  =  true ;  
![None.gif][] 438 .  \}  
![None.gif][] 439 .   
![None.gif][] 440 .  //  Friend's Feed Selector - Requires dev.php constant    
![None.gif][]  441 .  if  (is\_friendfeed\_user( $user )) \{  
![None.gif][] 442 .  $friendfeed  =  array ();  
![None.gif][] 443 .  $friendfeed \[ ' feeduser ' \]  =  $get\_feeduser ;  
![None.gif][] 444 .  $friendfeed \[ ' feeduser\_name ' \]  =  user\_get\_name( $get\_feeduser );  
![None.gif][] 445 .  $friendfeed \[ ' friends ' \]  =  user\_get\_all\_friends( $user );  
![None.gif][] 446 .  tpl\_set( ' friendfeed ' ,  $friendfeed );  
![None.gif][] 447 .  \}  
![None.gif][] 448 .   
![None.gif][] 449 .  $feed\_stories  =  feed\_adjust\_timezone( $user ,  $feed\_stories );  
![None.gif][] 450 .   
![None.gif][] 451 .  tpl\_set( ' feed\_off ' ,  $feed\_off  ?  redirect( ' privacy.php?view=feeds ' ,  null ,  false )  :  false );  
![None.gif][] 452 .  \}  
![None.gif][] 453 .  tpl\_set( ' feed\_stories ' ,  $feed\_stories );  
![None.gif][] 454 .   
![None.gif][] 455 .  render\_template( $\_SERVER \[ ' PHP\_ROOT ' \] . ' /html/home.phpt ' );  
![None.gif][]

\--------------------------------------

上午从TC看到[FaceBook源代码遭泄漏][FaceBook]，刚才去看TC的该页面，已经做了两点更新，下面跟大家分享一下：其一是FaceBook的Brandee Barker在评论留言中解释了一下造成此事的原因，另一件就是该文章作者Nik Cubrilovic在自己的博客上给出了预防PHP源代码泄漏的方法。

先说说第一件：FB官方给出的解释是，少数用户利用某台服务器的配置错误将源码泄漏出来，并且现在已经修复了此错误，且声明这不是安全缺口所以对用 私人数据并不会造成影响。不管是服务器配置错误或者符合超载，看来造成此事的原因是apache和mod\_php将未经解释的源代码直接输出。（原文）

> Some of Facebook’s source code was exposed to a small number of users due to a bug on a single server that was misconfigured and then fixed immediately. It was not a security breach and did not compromise user data in any way. The reprinting of this code violates several laws and we ask that people not distribute it further.

第二件Nik在博客上写了[四条预防PHP源代码泄漏][PHP]的方法：

1）使用[mod\_security][mod_security]过滤输出严防泄漏 Use mod\_security to filter output and prevent leakage （例如）

![None.gif][] PHP代码  
![None.gif][]  
![None.gif][] 1 .  SecFilterOutput On  
![None.gif][] 2 .  SecFilterSelective OUTPUT  " <?php "  log , deny  
![None.gif][]  
![None.gif][]

2）不要将关键敏感代码放到根目录中 Code should live outside of the web root （例如）

![None.gif][] PHP代码  
![None.gif][]  
![None.gif][] 1 .  index . php :   
![None.gif][] 2 .   
![None.gif][] 3 .  <? php  
![None.gif][] 4 .  include ( ' ../realroot/index.php ' );  
![None.gif][] 5 .  ?>   
![None.gif][]  
![None.gif][]

3）更改默认的文件类型 Change the default file type （例如对http.conf做如下修改）

![None.gif][] PHP代码  
![None.gif][]  
![None.gif][] 1 .  httpd . conf :   
![None.gif][] 2 .   
![None.gif][] 3 .  DefaultType application / x \- httpd \- php  
![None.gif][]  
![None.gif][]

4）绝对禁止访问根目录 Deny all outside of the webroot （假设你的根目录是 ‘www’ ，例如）

![None.gif][] PHP代码  
![None.gif][]  
![None.gif][] 1 .  http . conf :  (or  . htaccess)  
![None.gif][] 2 .   
![None.gif][] 3 .  < directory  />   
![None.gif][] 4 .  Order Deny , Allow  
![None.gif][] 5 .  Deny from all  
![None.gif][] 6 .  Options None  
![None.gif][] 7 .  AllowOverride None  
![None.gif][] 8 .   
![None.gif][] 9 .  < directory  / www >   
![None.gif][] 10 .  Order Allow , Deny  
![None.gif][] 11 .  Allow from all  
![None.gif][] 12 .  </ directory >   
![None.gif][]  
![None.gif][]

[TechCrunch]: http://www.techcrunch.com/2007/08/11/facebook-source-code-leaked/
[Facebook Secrets]: http://facebooksecrets.blogspot.com/
[None.gif]: /images/20220828/313b0c88fe38434e9b4f3e8b78b2361c.png
[FaceBook]: http://webeta.cn/?action=show&id=1641
[PHP]: http://www.nik.com.au/archives/2007/08/11/learning-from-facebook-preventing-php-leakage/
[mod_security]: http://www.modsecurity.org/