You are all assuming the one who took the photo didn't have authorization. PRC has unique way releasing info/pics on new military projects. This has been going on since early days of the J-10 program. So many photos will not be leaking out if there wasn't at least tacit approval.
Edit: Remember this?
View attachment 24114
I am also of the opnion that the photo was taken and uploaded with authorization. It was simply the way the PLA operates.
It's hard for me to believe that a major facility like the CAC doesn't have security in place to prevent such thing from happening, especially given the fact that smart phones are so common that it's almost like a watch. This is not 2001, when people were still not used to the idea of everyone could have a mini camera on them at all times. This is 2016, when it's almost a given that people should have a camera phone on them. Why would the CAC still not have any security measures to deal with it?
For instance, employees might be required to turn their phones and any other electronic devices in as soon as they step in the facility. In fact, movie theaters in China do this kind of things when they do premieres all the time. If even movie theaters have the capability and the will to do this, it makes no sense that a top security facility like the CAC would not do it and actually allows its employee to walk around with their phones.
A major facility like the CAC should also have tons of security cameras installed on site, which will cover every corner of the facility. We see that even super markets in China have security cameras. Why would the CAC not? The CAC will surely let its employees know that they are being watched 24/7. Why would anyone do stupid things like taking photos of the facility, which would get them in deep trouble? Even if this happens once in a while, the employee who did it would be captured immediately, dealt with immediately and made an example for every one.
Let's assume the unlikely event actually happens. Someone stupid enough actually takes a photo of the CAC facility and the J-20 and upload it. We know that China has a highly efficient Internet police force. They sweep the net all the time and delete messages and news deemed unsuited all the time. Some random news/message might get deleted seconds/minutes after it's out. I'm almost 120% sure that military sites and forums would be monitored constantly. Any new photos deemed not suitable would have been deleted almost instantaneously. If the photo in question is still on the site, that means it's allowed by the authorities and it was put there intentionally with official sanction. No doubt about it.