如何允许自定义基于 Drupal（和 PHP 混淆）构建的平台
我的公司正在大力扩展的 Drupal 核心之上构建一个平台。我有多个客户将使用该系统的单独实例，并且希望自定义主题和功能。
我正在尝试设计一个系统，允许他们添加主题和模块，其中一些主题和模块可能与我的某些模块交互，但不让他们访问实际代码。 （这不是开源的）
Facebook 和 Ning 这样做的方式是让开发人员托管自己的自定义代码，并对其进行回调。这对我来说实际上不起作用，因为这些站点需要完全自定义的能力，因此特定集成点的回调实际上不起作用。
一种选择是设置一个沙箱环境，其中自定义开发人员只能访问几个特定目录来构建他们的主题和自定义模块。然后，我们可以与 git 集成，在准备好时提交它们，并将它们与其余代码一起部署到生产中。这种设置的问题是开发人员必须远程开发并且必须使用我们的源代码控制系统。
更典型的设置是允许开发人员下载一些东西来构建他们的自定义代码。他们可以在本地进行开发并使用他们已有的任何源代码控制实践。由于我们不需要特定的点集成，因此我认为这不能成为针对单独服务器运行的库。另一种方法是下载我们的完整核心 Drupal 系统并针对该系统进行本地开发，在准备好后上传自定义代码，然后他们就可以访问我们的所有代码和 IP。
因此陷入困境，因为我认为没有任何方法可以有效地混淆 PHP。
这里有人有什么绝妙的想法吗？
My company is building a platform on top of a heavily extended Drupal core. I have multiple customers who will be using separate instances of this system and will want to customize both the theme and the functionality.
I'm trying to design a system to allow them to add themes and modules, some of which might interact with some of my modules, without giving them access to the actual code. (This isn't open source)
The way that Facebook and Ning do this is to have the developer host their own custom code, and have a callback to it. This won't really work for me, as these sites need the ability to be fully customized, so callbacks for specific integration points don't really work.
One option is to set up a sandbox environment where the custom developers only have access to a couple specific directories to build their themes and custom modules. We could then integrate with git to commit these when they're ready and deploy them with the rest of our code into production. The problem with this setup is that developers have to develop remotely and have to use our source control system.
A more typical setup is to allow the developers to download something to build their custom code against. They can develop locally and use whatever source control practices they already have. As we don't want specific point integrations, I don't think this can be a library that runs against a separate server. The alternative is to download our full core Drupal system and develop locally against that, uploading the custom code when it's ready, but then they would have access to all our code and IP.
Thus the predicament, as I don't think there is any way to effectively obfuscate PHP.
Anyone have any brilliant ideas here?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
听起来你的系统是 Drupal 的衍生作品，因此受到 GPL 的保护。如果您将代码分发给客户，他们将拥有 GPL 提供的所有权利，包括修改和重新分发代码。
请注意，不允许分发混淆的 GPL 代码。引用 GPLv2 的话：“作品的源代码是指对其进行修改的作品的首选形式。”
混淆代码不符合 GPL 的这一条款。
也就是说，如果您确实想为客户提供一种自定义系统的方法，您可以为客户提供对现有 Drupal 模块和主题系统的访问权限，但只能在您的沙箱上进行。
当然，由于模块和主题是 PHP 并且您“不需要特定的点集成”，因此他们似乎拥有某种自由，可以让他们编写一个模块来读取系统其余部分的所有源代码然后将其压缩并发送给他们自己。
我认为您已经因为依赖 GPL 而陷入了困境。保持您的 IP 私有，同时允许您的客户以一般方式扩展/定制系统，这实际上是行不通的。
It sounds like your system is a derivative work of Drupal and thus covered by the GPL. If you distribute the code to your clients they have all of the rights provided by the GPL, Including modifying and redistributing it.
Be aware that distributing obfuscated GPLed code is not allowed. To quote the GPLv2 "The source code for a work means the preferred form of the work for making modifications to it."
Obfuscated code does not comply with this clause of the GPL.
That said, if you really want to provide your clients a way to customize your system you could provide your clients access to the existing Drupal module and theme system but only on your sandbox.
Of course since the modules and themes are PHP and you "don't want specific point integrations" it seems they would have the sort of freedom that would allow them to write a module that reads all of the source code for the rest of your system and then tar it up and send it to themselves.
I think you've painted yourself into a corner by depending on GPL. Keeping your IP private while allowing your clients to extend/customize the system in general ways doesn't really work.
我希望您知道 Drupal 已GPL 许可，请务必阅读他们的许可常见问题解答，然后再开始混淆。
I hope you're aware that Drupal is GPL licensed, be sure to read their licensing FAQ before you start obfuscating.
为什么不直接为他们创建一个只能访问 /sites/irsite 的 FTP 用户呢？我缺少什么？
Why not just create an FTP user for them which can only access /sites/theirsite? What am I missing?