# Technical documentation — efiling

Evidence date: 2026-10-15. Revision: `master` `67e722d` (2019-05-22, commit `67e722dc541bcceb00657aa4f6ed0644a769fb7d`).

The commit is one snapshot. It is not an application you can boot. Stack traces inside the snapshot describe the PHP process that was running on disk outside git.

No database password is stored in the files that were read. An account name and the host `cp01-jhb.teamwizz.com` are inside `error_log` on an access-denied line. The account name is not repeated in this document.

## Architecture

Two layers. Only the first is in git.

```text
Git tree (master @ 67e722d)
  index_test.php                 static maintenance HTML
  down/index.phtml               theme shell, one PHP header() call
  css/ js/ img/ style/ dist/     admin theme and Cropper
  font-awesome-4.4.0/            icon font
  charts/ source/                Highcharts examples, CanvasJS
  dompdf/                        partial upstream tree
  Classes/PHPExcel/              locale data, no PHP
  uploads/ uploads.zip           stored documents
  error_log, Efiling_Grnd_Error* production logs

Server tree named by those logs (not in git)
  /home/saruefiling/public_html/
    public/index.php             Zend_Application->run() at line 38
    application/controllers/
    application/models/
    application/views/scripts/
    application/layouts/default.phtml
    library/Zend/
    public/uploads/
    public/dompdf/include/cellmap.cls.php
  /home/zimrugby/public_html/    second root in the same error_log
    app/ and application/        both path styles appear
    library/Zend/
```

Provenance of the git tree: **Implemented**. Provenance of the server tree: **Observed** in logs.

Request path on the server, from the ground-error stacks:

1. `public/index.php`
2. `Zend_Application->run()`
3. `Zend_Application_Bootstrap_Bootstrap->run()`
4. `Zend_Controller_Front->dispatch()`
5. `Zend_Controller_Dispatcher_Standard`
6. `Zend_Controller_Action->dispatch` of an action such as `savegrantAction`
7. Model insert through `Zend_Db_Table_Abstract` and `Zend_Db_Adapter_Pdo_Mysql`

`Zend_Controller_Plugin_Broker` is on the stack, so front-controller plugins ran. The only plugin class named in a fatal is `PG_Controller_Plugin_EmailLayout`.

## Languages and frameworks

| Layer | What is in git | What the logs add |
|---|---|---|
| Application | Not present | PHP, Zend Framework 1 |
| Page in git | HTML in `index_test.php`. One short-echo tag in `down/index.phtml` | |
| Browser assets | JavaScript, CSS | jQuery banner inside `jquery-1.10.2.min.js` says v1.11.1. jQuery UI file banner says v1.10.1 |
| Database | No schema, no SQL files | MySQL, PDO, table `grantsrequest` |
| PDF | dompdf README, fonts, demo includes | Server class `cellmap.cls.php` under `public/dompdf/include/` |
| Spreadsheets | PHPExcel locale text only | No PHPExcel class name in the summarised fatals |
| Tests | None | `TestController` is an application controller, not a test suite |
| CI / deploy | No pipeline, no Dockerfile, no `.htaccess`, no `application.ini`, no root Composer file | Deploy method Unknown |

dompdf's own `composer.json` names package `dompdf/dompdf`, license LGPL, and requires `phenx/php-font-lib` `0.2.*`. A `dompdf/lib/php-font-lib` directory exists. The dompdf PHP sources that `head.inc` loads (`dompdf_config.inc.php`, `functions.inc.php`) do not.

PHP version on the server is **Unknown**. The code uses Zend Framework 1 and `iconv_get_encoding()` as a function, which fits PHP 5.x more than a current PHP 8 runtime. That fit is **Inferred**, not a version pin.

## Repository layout

2,466 files. Counts below are from a listing of `67e722d`.

| Path | Scale | Role |
|---|---|---|
| `README.md` | Heading `# efiling` only | No setup steps |
| `index_test.php` | HTML maintenance page | See PRD W1 |
| `down/index.phtml` | Theme shell | See PRD W2 |
| `favicon.ico` | Present at root | Linked as `/favicon.ico` |
| `Background4_2018_maintenance.jpg` | Image at root | Filename only. Not referenced by the two pages that were read |
| `bootstrap.css` | Also under `css/` and `style/` | Theme |
| `css/` | 47 files, including `login.css`, `stylesheets.css`, `anon.css` | Skin. `oldcss/` is not a directory |
| `js/` | 81 files plus `js/plugins/` (jquery, bootstrap, dataTables, elfinder, fullcalendar, plupload, select2, validation, others) | Skin and plugins |
| `img/` | 640 files | Theme images, `img/users/`, logos. User images were not opened |
| `style/` | 15 files | Alternate theme colours (blue, brown, green, orange, red, yellow) |
| `font-awesome-4.4.0/` | 35 files | Icons used by `down/index.phtml` |
| `dist/` | Cropper CSS and JS | Linked by `down/index.phtml` |
| `charts/` | 213 files | Highcharts examples. Title in `charts/index.htm` is "Highcharts Examples" |
| `source/` | CanvasJS scripts | Chart library |
| `scroller/` | Small demo (`index.html`, css, js) | Not referenced by the maintenance pages |
| `Simple/` | progress-circle demo and its README | jQuery percentage circle. Not referenced by the maintenance pages |
| `lib/` | css and js | Not part of the Zend library. The Zend library is only on the server path `library/Zend` |
| `dompdf/` | 307 files, almost all non-PHP | See below |
| `Classes/PHPExcel/` | 39 files under `Classes/`, zero `.php` | Locale and shared text |
| `uploads/` | 1,020 files | Documents |
| `uploads.zip` | 233,142,747 bytes, 738 entries, prefix `uploads/`, zero PHP | A second copy of the same kind of documents. Not extracted for this review |
| `error_log` | 580,366 bytes, 2018-03-14 20:43 to 2019-05-15 09:18, zone `Africa/Johannesburg` | Mixed saruefiling and zimrugby |
| `Efiling_Grnd_Error*` | 21 files, filename dates 2018-05-03 through 2019-05-14 | Uncaught grant-insert exceptions |

PHP and include files actually committed:

| File | What it contains |
|---|---|
| `index_test.php` | HTML only. No `<?php` |
| `down/index.phtml` | HTML plus `<?=header('Content-Type: text/html; charset=utf-8');?>` in the head |
| `dompdf/www/head.inc` | Demo: `session_start()`, `require_once "../dompdf_config.inc.php"`, `require_once "functions.inc.php"`, `auth_check()` |
| `dompdf/www/foot.inc` | Demo footer include |

## Server application map

Controllers cited by path. None are in git.

| Controller file | Actions or views also cited |
|---|---|
| `IndexController.php` | `views/scripts/index/index.phtml` |
| `GrantsController.php` | `savegrantAction` at line 1265 (2018-05-03 dump) and line 1270 (2019 dumps) |
| `PlanController.php` | `plan/listprojects.phtml`, `plan/getprojects.phtml` |
| `PdfController.php` | Public route `/pdf/print/...` |
| `MembersController.php` | `Model_Profile` |
| `OrganisationsController.php` | Path only |
| `TournamentsController.php` | `dashboard/tournaments.phtml` |
| `EpgController.php` | `epg/formfiles.phtml`, `epg/loadform.phtml` |
| `TestController.php` | Output started at line 9 |

Models:

| Class | Methods or table seen |
|---|---|
| `Model_GrantsRequests` | `insertData` writes table `grantsrequest`. Callers also use `fetcRow`, which is not defined (typo for `fetchRow`) |
| `Model_Profile` | `getAllMembers` defined around line 158 with at least 7 parameters. `getUsername` called and missing |
| `Model_Unions` | File path only, plus array keys `UnionsArray` and `listUnions` in notices |

Database objects named in errors:

| Name | Evidence |
|---|---|
| Table `grantsrequest` | `INSERT INTO` in the ground-error stacks |
| Column `RequiredGrant` | Integer. Value `undefined` rejected |
| Host `cp01-jhb.teamwizz.com` | Access denied for a MySQL user, password was supplied, from `Zend_Db` |
| Other failures | Connection refused, DNS lookup failure, "MySQL server has gone away", greeting-packet warning |

Schema, indexes, and foreign keys are **Unknown**.

## Authentication

Server: `Zend_Auth` with `Zend_Auth_Storage_Session`. Session exceptions when output started first (`public/index.php` line 15, `TestController.php` line 9, `down`-style early output).

Browser theme: `css/login.css`, `js/actions.js` `loginBlock`. No credential check in those files.

Idle timeout plugin files are present (`js/jquery.idletimeout.js`, `js/jquery.idletimer.js`, copyright 2011). No application page in git sets `idleAfter`. The session length is **Unknown**.

## File storage

Server directory: `/home/saruefiling/public_html/public/uploads/`.

Git copies: `uploads/` and `uploads.zip`.

`uploads/` extension counts: pdf 491, docx 316, xlsx 118, doc 33, xls 29, jpg 13, csv 5, plus a handful of other types including three inner zip files and one html file.

The unlink warning shows the code building a path with an empty `fileNameNew` and then calling `unlink` on the directory.

## PDF

Production include path: `/home/saruefiling/public_html/public/dompdf/include/cellmap.cls.php`.

One fatal: `Call to undefined method DOMText::getAttribute()`.

The print URL is fetched with `file_get_contents` from inside the application (caller line 1451), so PDF generation called back to `http://saruefiling.com` over HTTP. That call failed for the logged pages. Scheme in the log is `http`, not `https`.

## Mail

`PG_Controller_Plugin_EmailLayout::EmailTemplate3` is undefined. No SMTP host, from-address, or template file is in git. Mail transport is **Unknown**.

## Background work, queues, cache

No cron, queue, worker, or cache configuration is in the tree. None is named in the summarised log lines. **Unknown** whether any existed on the server.

## Environment and configuration

Not in git: `.env`, `application.ini`, Apache or nginx config, `.htaccess`.

Observed from logs:

| Item | Value |
|---|---|
| Timezone | `Africa/Johannesburg` on log timestamps |
| Memory limit | 83,886,080 bytes (80 MiB) and 838,860,800 bytes (800 MiB), both exhausted inside `Zend_Db_Statement_Pdo` |
| iconv | Missing on the zimrugby host at the time of the locale fatals |
| Public origin | `http://saruefiling.com` |
| Account home directories | `saruefiling`, `zimrugby` under `/home/` |

How configuration was chosen per host is **Unknown**.

## Security notes from the snapshot

These are properties of the commit, not a penetration test.

- `error_log` and the ground-error files are production traces in a git repository. They include SQL fragments, server paths, and a database account name on `cp01-jhb.teamwizz.com`.
- `uploads/` and `uploads.zip` are real funding documents (invoices, reports, applications), not fixtures. Personal names appear in some filenames. Contents were not copied into Silicon Ark.
- Grant insert failures show user text reaching the SQL column list. That is an injection-shaped defect in the server code that is not available here to fix.
- `down/index.phtml` sends a content-type header after HTML has started.
- The maintenance page loads a third-party script from `use.fontawesome.com` with a pinned integrity hash (`sha384-8iPTk2s/jMVj81dnzb/iFR2sdA7u06vHJyyLlAd4snFpCl/SnyUjRrbdJsw1pGIl`) and `crossorigin="anonymous"`.
- `index_test.php` has no authentication because it has no application.

Whether those logs and uploads should stay on `master` is a human decision. See the project plan confirmation list.

## Development and testing

No PHPUnit, no fixture database, no seed, no readme setup, no CI. The single commit message is `#119 First Commit`. Author of that commit is Jaco Brits, 2019-05-22 12:51:30 +0200.

`js/test/` exists as a theme folder. It was not a project test suite in the files sampled.

Opening `index_test.php` in a browser shows the maintenance HTML. That is the only page in git with finished copy. It does not exercise grants, plans, PDF, or login.

## Related paths that are easy to confuse

| Path | What it is |
|---|---|
| `library/Zend` on the server | Zend Framework 1 |
| `lib/` in git | Front-end css and js |
| `Classes/PHPExcel` in git | Incomplete PHPExcel data files |
| `dompdf/www/head.inc` `auth_check` | Upstream demo login, not SARU |
| `TestController` | Application controller on the server |
| `/home/zimrugby/public_html` | Second root inside `error_log`, not a branch in git |