# Technical documentation — FootprintApp.net

Evidence date: 2026-10-14. Revision: `master` `629b199a` (2022-12-13). Deploy branch `prod` is later (`017d6aa0`, 2023-02-20) and was not the tree this file describes.

Credentials are present in git. This file names the files and the hosts. It does not repeat passwords, API keys, or the login bypass string.

## Architecture

Monolithic PHP application on Zend Framework 1.11.10 (`library/Zend/Version.php`, `const VERSION = '1.11.10'`).

Request path:

1. Root `.htaccess` rewrites any URI that does not already start with `/public/` to `public/{uri}`.
2. `public/.htaccess` serves existing files and otherwise rewrites to `public/index.php`.
3. `public/index.php` defines path constants, puts `library/` on the include path, requires `Zend/Application.php`, `Other/Functions.php`, and `Other/Notifications.php`, and runs `Zend_Application` with `application/configs/application.ini`.
4. `Bootstrap` is empty at runtime. An older database init is commented out.
5. The front controller module directory is `application/modules`. Plugin `PG_Controller_Plugin_LayoutPicker` sets the layout name to the module name on `preDispatch`.
6. Default layout file is `default` (`resources.layout.layout`). Ini also sets layout names for admin, union, referee, app, gir, and accreditations. The plugin overwrites the layout with the module name, so those ini lines only matter if the plugin does not run.

`APPLICATION_ENV` comes from the environment, or `production` when unset. Ini sections `staging`, `testing`, and `development` inherit `production`, including the database. All of them keep `display_errors` off and `displayExceptions` off.

There is no service layer. Controllers instantiate `Model_*` classes, which extend `Zend_Db_Table`. SQL is often a string with interpolated request values.

The checkout contains 12,217 files. `git rev-list --count master` is 1578.

## Application structure

```text
FootprintApp.net/
├── application/
│   ├── Bootstrap.php
│   ├── configs/application.ini          (tracked; also listed in .gitignore)
│   ├── layouts/                         one phtml per module family
│   ├── models/                          Zend_Db_Table classes and DbTable/
│   └── modules/
│       ├── default/                     main UI
│       ├── admin/
│       ├── union/                       Team Zone
│       ├── union_old/
│       ├── app/
│       ├── gir/
│       ├── live/
│       ├── pub/
│       ├── referee/
│       ├── accreditations/
│       ├── printers/
│       └── api/
├── library/
│   ├── Zend/                            1.11.10
│   ├── PG/Controller/Plugin/            layout, mail, upload, fpdf
│   └── Other/                           Functions.php, Notifications.php
├── public/                              web root, assets, TCPDF, dompdf, class/sms.php
├── scripts/                             CodeDeploy hooks
├── appspec.yml
├── bitbucket-pipelines.yml
├── codedeploy_deploy.py
├── composer.json                        empty object
├── mssql.php
├── boksmartmssql.php
├── phpinfo.php
└── index.html                           debug leftover, not the app home
```

Zend default routing is `/{module}/{controller}/{action}` with `default` as the default module, so `/login/logout` is `default` module, `login` controller, `logout` action. No custom router resource is declared in `application.ini`.

`appnamespace` is an empty string. Model classes are named `Model_{Name}` and live in `application/models/`. Module controllers use class names such as `IndexController` (default) and `Admin_IndexController`, `Live_ScoreController`.

## Languages and frameworks

| Item | Evidence |
|---|---|
| PHP | Controllers, models, `public/index.php`. Version required by the host is **Unknown**. The code uses `mssql_*` in root scripts (removed from modern PHP) and `Zend_Application`. |
| Zend Framework 1.11.10 | Vendored under `library/Zend` |
| JavaScript / jQuery UI 1.12.1 | `public/jquery-ui-1.12.1`, `public/js` |
| Python 3.5.7 | `bitbucket-pipelines.yml` image, used only to zip and call CodeDeploy |
| Bash | `scripts/*` |
| SQL | MySQL via `pdo_mysql`; T-SQL in `boksmartmssql.php` |

`composer.json` is `{}`. The pipeline does not run Composer.

## Databases

### Default MySQL

From `application/configs/application.ini` production section:

| Key | Value |
|---|---|
| Adapter | `pdo_mysql` |
| Host | `db.footprintapp.net` |
| Database | `teamwizz_SARU` |
| Username | present in the file; omitted here |
| Default table adapter | true (set twice) |

Tables and views referenced by code that was read:

| Name | Used by |
|---|---|
| `profile` | `Model_Profile` |
| `UserLogin_view` | Auth adapter and login lookup |
| `user_type` | `Model_UserType` |
| `AccessControl` | `Model_AccessControl` |
| `Users_view` | `Model_Profile::getImagesByIds` |
| `player1_view` | `Model_Profile::moveProfiles` |
| `AccreditationApplication` | Named in commit `2d377106` (column `services`) |

Other model `$_name` values were not all extracted. There is no migration directory. Schema history is **Unknown**.

### API log database

`apilogs.db.params` points at the same host and database name `teamwizz_API`. No bootstrap code registers that adapter. Whether application code reads those keys is **Unknown**.

### Commented MySQL

`Bootstrap::_initDb` is commented. It would have used host `footprintapp.net` and database `evolveci_sarugry`. It does not run.

### MSSQL scripts (not part of the web bootstrap)

| File | What it does |
|---|---|
| `mssql.php` | `mssql_connect` to an Amazon RDS SQL Server endpoint in `eu-west-1`, prints connected or a failure string, then closes. No query. |
| `boksmartmssql.php` | `mssql_connect` to a hardcoded IP and port, selects `BokSmartNumber` and `ExpiryDate` from `Officials` left-joined to `Courses` for one hardcoded number, prints the expiry. |

Neither file is required by `public/index.php`.

### SQLite file

`public/database.sqlite3` is in the tree. No reference was traced. Purpose: **Unknown**.

## HTTP API

Base path `/api/{controller}/{action}`. Action inventory is in `features.md`. Responses that were seen in the login controller are JSON. Other actions mix JSON, files, and HTML. There is no API version prefix and no route file.

`SmsController` is not under `api`. It is a default-module controller that returns no view.

`EmailController::sendAction` exists at `/email/send`. Payload fields were not read in this pass. Silicon Ark for `track.mypass.zone` describes a commented caller that posts `Email`, `FullName`, and `Content`.

## External integrations

| Integration | Where | Notes |
|---|---|---|
| Gmail SMTP | `library/PG/Controller/Plugin/EmailLayout.php` `sendMail` | Host `smtp.gmail.com`, port 587, TLS. From `support@footprintapp.net` / `Footprint`. Password in source, omitted. |
| Accreditation mail | Same file, second method | From `accreditation@magus.events` / `Magus.Events`. |
| MyMobileAPI | `public/class/sms.php` class `MyMobileAPI` | URL `http://www.mymobileapi.com/api5/http5.aspx`. Used by `SmsController`. |
| Ampath | `api/AmpathController::pushresultsAction` | Comment: results pushed from Ampath (POST). |
| MyPass-style clients | `api/MypassController` | Many actions; auth scheme **Unknown**. |
| SparkPost tree | `public/SparkPost` | Present. The mail method that was read uses Zend_Mail SMTP, not this directory. |
| AWS S3 and CodeDeploy | `codedeploy_deploy.py` | boto3 1.3.0 installed in the pipeline. Bucket and application names come from environment variables. |

## Infrastructure and deployment

`appspec.yml`:

- OS `linux`
- Copy `/` to `/mnt/data/www/html/footprintapp.net/footprintapp.net/`
- Owner and group `apache`
- `BeforeInstall`: `scripts/install_dependencies` (`yum install -y httpd`) as root, timeout 300
- `ApplicationStop`: `scripts/remove_archives.sh` (deletes old CodeDeploy revision directories except the last successful install)
- `ApplicationStart`: `scripts/start_server` (`service httpd start`)

`scripts/stop_server` is not referenced by `appspec.yml`. Its `isExistApp = \`pgrep httpd\`` assignment is not valid bash (spaces around `=`).

`bitbucket-pipelines.yml` image `python:3.5.7`:

| Branch | Step |
|---|---|
| `qa` | Export `QA_AWS_ACCESS_KEY_ID`, `QA_AWS_SECRET_ACCESS_KEY`, `QA_AWS_DEFAULT_REGION`, `QA_APPLICATION_NAME`, `QA_DEPLOYMENT_GROUP_NAME`, `QA_S3_BUCKET`. Install zip and boto3 1.3.0. `zip -r /tmp/artifact.zip *`. Run `codedeploy_deploy.py`. |
| `prod` | Same with `PROD_*` variables. |

`master` and `dev` have no pipeline step. The zip command packages the pipeline working directory. It does not exclude `.git` by an explicit flag in the yaml. Whether Bitbucket's checkout includes `.git` in that zip is **Unknown**.

`codedeploy_deploy.py` is the Amazon Bitbucket Builds template (header copyright 2016, author narshiva@amazon.com). It uploads the zip to S3 and creates a CodeDeploy deployment. A comment in the file says "PROD Code Deploy". The same script is used for the QA step; the AWS application is selected only by environment variables.

## Environment configuration

| Source | What it sets |
|---|---|
| `APPLICATION_ENV` | Ini section. Default `production`. |
| `application.ini` | PHP error display, database, locale, session lifetime, module directory, layout |
| Bitbucket deployment variables | AWS keys and CodeDeploy names. Not in git. |
| `public/index.php` constants | `UPLOADS_PATH`, `DOCS_PATH`, `FILES_PATH`, `CLASS_PATH`, `CLASSES_PATH`, `TCPDF_PATH`, `IMG_PATH`, `AC_PATH`, `SITEDOC`, `LOCALDATA`, `ART_PATH`, `PLS_PATH`, `PLSH_PATH` |

`.gitignore` lists `application/configs/application.ini`, `public/error_log`, accreditation archive/photo paths, `public/uploads/`, `public/IMGS/`, `public/local_data/`, and `public/mailssent/`. The ini file is still tracked (commits through December 2022 update it). Gitignore does not remove tracked files. Root `error_log` and `phpinfo.php` are in the clone, so they are tracked. `public/error_log` is ignored.

`application.ini.bak.12-11-2021` is a second config file in `application/configs/`. It is not the file the front controller loads.

## Authentication

`Zend_Auth_Adapter_DbTable` on `UserLogin_view`, identity column `Username`, credential column `Password`, no `setCredentialTreatment`. The caller passes the stored password after a prior `md5` comparison, so the adapter compares stored hash to stored hash.

Session cookie lifetime 864000 seconds. Additional cookie `FootPrintApp` for 86400 seconds.

Login bypass: see `business-rules.md` BR-001. The string is not repeated.

Password storage: `md5`. Reset keys: `md5(uniqid())`.

`admin` module init skips the login redirect for an empty user-agent or Internet Explorer.

## Background work

No queue library and no worker process are defined. `CronController` exposes HTTP actions (`autoruntoo`, `schedualing`, `queingold`, `matches`, `logs`, `getfixtues`, `bluecardconsentscleanup`, `participationgenerate`, and others). `EfbuilderController::jotcronAction` is another HTTP entry. The scheduler that calls them is **Unknown**.

## Storage

Upload and generated files are expected under the `public/index.php` constants (uploads, xls, files, accreditation `public/accre`, images, players, terms text, local data). Several of those directories are gitignored. PDF libraries on disk: `public/tcpdf`, `public/TCPDF-master`, `public/dompdf`, `public/html2pdf-master`.

## Monitoring and security

No application monitoring agent, health check, or log library is configured in the tree. `ErrorlogsController` exists. PHP `display_errors` is off in ini. `SmsController` turns `display_errors` on for its own requests.

Observations from the code, stated so they can be reviewed. This is not a pentest procedure.

- Database, SMTP, and MSSQL passwords are committed. `.gitignore` lists `application.ini` but the file remains in history.
- Login accepts a fixed password that selects the account by username only.
- Login and other queries concatenate input into SQL.
- Password reset links are `http`, and new-user mail contains the plaintext password.
- `md5` is the password hash.
- `phpinfo.php` is in the repository root.
- Root `.htaccess` does not force HTTPS (the rules are commented out).
- `live` scoring init does not check `Zend_Auth`.
- `admin` init exempts Internet Explorer and an empty user-agent from the login redirect.
- Pipeline image `python:3.5.7` and `boto3==1.3.0` are past upstream support. That is an observation, not a runtime of the PHP app.

## Development and testing

No `phpunit.xml`, no `tests/` directory, and no CI test step. `changelog.txt` is two entries from May 2019. README is the heading `# FootprinLive`.

Local development is **Unknown**. The `development` ini section does not point at a different database.

Editors: `.vscode` is in the tree.

Sonar: OVER-124's scan-host listing included `sonar-project.properties` and `sonarqube_scan.bat`. They are not in `master`.

## Related codebases

`FootPrintLive` in Silicon Ark is a separate 2019 snapshot (`footprintlive.git`) with the same UI title and database name. `footprintapp-Not-Used` is an earlier large tree of the same family. They are not branches of this remote. See `project-plan.md`.