# Technical documentation — footprintapp-Not-Used

Evidence date: 2026-10-14. Source: `git@bitbucket.org:overdrive/footprintapp-not-used.git`, `master` at `593bd151015e4d8d264ba5518ecf172368135711`.

Provenance labels: **Documented**, **Implemented**, **Inferred**, **Planned**, **Unknown**.

No technical document existed in the repository or in `silicon_ark/footprintapp-Not-Used/` before this file. There is no README.

## What this repository is

A single-commit dump of a Zend Framework 1 PHP application titled Footprint, plus vendored libraries, phpMyAdmin, and a large `public/` file store. The author of `593bd151` is `root <root@ip-10-0-2-5.eu-west-1.compute.internal>` on 2019-09-06 09:05:47 +0000. The message is `Initial Commit`. The commit has no parents.

Provenance: **Implemented** (`git log`, `git ls-tree`).

It is not `footprint-not-used.git` (Silicon Ark directory `Footprint-Not-Used`) and not `footprintlive.git` (Silicon Ark directory `FootPrintLive`). Those remotes have different tips. `FootPrintLive` also configures MySQL database `teamwizz_SARU`. The trees were not diffed.

## Inspection method

1. `multica repo checkout` of this slug was refused: `repo is not configured for this workspace`.
2. `git ls-remote git@bitbucket.org:overdrive/footprintapp-not-used.git HEAD` printed `593bd151015e4d8d264ba5518ecf172368135711`.
3. A full clone enumerated 46,124 objects and was stopped. A blobless clone (`--filter=blob:none --depth 1`) received 2,631 objects.
4. `git checkout` of the working tree failed on Windows: `invalid path 'public/accre/achive/ccpb_05072018171155/Jannie Kleinhans  	 -11423.pdf'`. The clone still has the commit. Names came from `git ls-tree`. Bodies cited here came from `git show`.
5. `git status` after the failed checkout reports `master...origin/master` and lists the tree as deleted in the index, because the work tree is empty. That status is a checkout failure, not a commit that deleted the application.
6. The scan-host path was not on this machine.
7. Bitbucket HTTP metadata returned 401. `origin/HEAD` still points at `origin/master`.

`git rev-list --all --count` is 1. There are no tags and no other branches. Depth 1 therefore did not hide earlier commits. The remote has one commit.

## Application structure

```text
footprintapp-not-used/
├── .htaccess
├── htaccess.bak.040519
├── changelog.txt
├── phpinfo.php
├── mssql.php
├── boksmartmssql.php
├── api_log/api_log.txt
├── application/
│   ├── Bootstrap.php
│   ├── configs/application.ini          (+ two "Copy" ini files)
│   ├── layouts/*.phtml
│   ├── models/                          (270 PHP files)
│   └── modules/
│       ├── accreditations/
│       ├── admin/
│       ├── api/                         (controllers, no view scripts)
│       ├── app/
│       ├── default/
│       ├── gir/
│       ├── live/
│       ├── printers/
│       ├── pub/
│       ├── referee/
│       ├── union/
│       └── union_old/
├── library/
│   ├── Zend/                            (2,872 paths, ZF 1.11.10)
│   ├── PG/Controller/Plugin/
│   └── Other/Functions.php
│   └── Other/Notifications.php
├── phpMyAdmin/                          (2,569 paths)
└── public/
    ├── index.php
    ├── accre/                           (31,507 paths)
    ├── IMGS/  local_data/  css/  cssold/  js/
    ├── tcpdf/  dompdf/  Classes/  SparkPost/
    └── class/sms.php
```

Counts are from `git ls-tree -r --name-only HEAD` (48,440 paths). Extension totals include vendored trees: 22,559 `.pdf`, 12,744 `.jpg`, 5,079 `.php`, 1,964 `.png`, 1,570 `.phtml`.

`library/` is 2,894 paths: `library/Zend` 2,872, `library/PG` 19, `library/Other` 2, plus one `.DS_Store`. `phpMyAdmin/` is 2,569 paths.

## Request path

Root `.htaccess`:

- `RewriteEngine On`.
- URIs under `/phpinfo.php` and `/phpMyAdmin/` are excluded from the rewrite.
- URIs that do not already start with `/public/` are rewritten to `public/{path}`.
- HTTPS and `www` redirects are commented out.

`public/index.php`:

- `memory_limit` 200M.
- Timezone `Africa/Johannesburg`.
- `APPLICATION_ENV` from the environment, otherwise `production`.
- `APPLICATION_PATH` is `../application`.
- Path constants for uploads, docs, files, classes, TCPDF, images, accreditations, terms, local data, artists, and players.
- Include path adds `library/`.
- Requires `Zend/Application.php`, `Other/Functions.php`, `Other/Notifications.php`.
- Starts `Zend_Session`, bootstraps, runs.

`library/PG/Controller/Plugin/LayoutPicker.php` sets the layout name to the module name on `preDispatch`. The ini registers that plugin as `resources.frontController.Plugins.LayoutPicker`. The ini also sets `resources.layout.layout = default` and repeats layout names under module-like keys (`admin.resources.layout.layout`, and the same for union, referee, app, gir, accreditations). The plugin overwrites the layout with the module name at preDispatch. Provenance: **Implemented**.

`application/Bootstrap.php` declares `Bootstrap extends Zend_Application_Bootstrap_Bootstrap`. The only method, `_initDb`, is inside a block comment. Database setup comes from the ini resource, not from this class. Provenance: **Implemented**.

## Configuration

`application/configs/application.ini` sections: `production`, `staging` (inherits production, empty), `testing`, `development`.

| Key | Production value |
|---|---|
| `phpSettings.display_startup_errors` / `display_errors` | 0. Both 1 in `testing` and `development` |
| `resources.frontController.params.displayExceptions` | 0. 1 in `development` only |
| `resources.frontController.moduleDirectory` | `APPLICATION_PATH "/modules"` |
| `resources.locale.default` | `af_ZA` |
| `resources.session.cookie_lifetime` | `864000` |
| `autoloaderNamespaces.pg` | `PG_` |
| `resources.db.adapter` | `pdo_mysql` |
| `resources.db.params.host` | `localhost` |
| `resources.db.params.username` | `teamwizz_ADMIN` |
| `resources.db.params.password` | Present in the file. Not copied |
| `resources.db.params.dbname` | `teamwizz_SARU` |
| `apilogs.db.params.host` | `localhost` |
| `apilogs.db.params.username` | `teamwizz_ADMIN` |
| `apilogs.db.params.password` | Present. Not copied |
| `apilogs.db.params.dbname` | `teamwizz_API` |

`resources.db.isDefaultTableAdapter` is set twice to true. `apilogs.db` is not a `resources.db` plugin block. Nothing read in this pass opens that second database. Provenance: **Implemented** as ini text. Runtime use of `teamwizz_API` is **Unknown**.

Two extra ini files, `application - Copy.ini` and `application - Copy (2).ini`, are tracked. They were not compared.

The commented bootstrap names a different target: host `footprintapp.net`, database `evolveci_sarugby`. It is not loaded.

## Authentication

`LoginController::getAuthAdapter` builds `Zend_Auth_Adapter_DbTable` on the default adapter, table `UserLogin_view`, identity `Username`, credential `Password`. No `setCredentialTreatment` was seen in that method, so the adapter's default comparison applies to whatever string `LoginNow` supplies.

`indexoldAction` uses `md5` of the typed password. The terms and `loginuser` paths can substitute a stored password when a fixed string is submitted. See `business-rules.md`. The fixed string, the database password, the SMS password, and both MSSQL passwords are in Git and are intentionally absent from this document.

Session cookie lifetime is 864000 seconds. The index action also sets a separate cookie named `FootPrintApp`.

## Modules and layouts

| Module | PHP controllers (count of files seen) | View paths under the module | Layout file |
|---|---|---|---|
| `default` | Many, including login, members, squad, tournament, fixture, blue card, food, sms, cron, pdf, cms | 784 | `default.phtml` |
| `admin` | Error, Index, Members | 331 | `admin.phtml` |
| `app` | Squads, fixtures, tournaments, members, and others | 136 | `app.phtml` |
| `union` | Same family as `app` | 137 | `union.phtml` |
| `union_old` | Same family, fewer views | 93 | None named `union_old.phtml`. The picker would still request that layout name |
| `gir` | Dario, fixtures, image, index, members, squads, tournaments, test | 45 | `gir.phtml` |
| `accreditations` | Application, Checkout, Collections, Index, Error | 16 | `accreditations.phtml` |
| `live` | Calendar, fixtures, index, referee, score, timer, tournament | 26 | `live.phtml` |
| `api` | Login, fixtures, players, teams, tournaments, accreditation, getdata, mobile updates, error | 0 | None |
| `referee` | Assessment, calendar, index, referee | 11 | `referee.phtml` |
| `pub` | Calendar, index, referee | 6 | `pub.phtml` |
| `printers` | Index, error | 8 | `printers.phtml` |

Controller file names that contain `Copy` or `test` are listed in `features.md`.

## Data

No schema dump, migration directory, or ORM mapping file was found at the application root. Models are PHP classes under `application/models/` (270 files) and further copies appear inside modules. `protected $_name` was not extracted for every class. The one relation confirmed by an auth call is the view `UserLogin_view`.

`public/accre/` is an on-disk archive (the path segment `achive` is spelled that way). One object name contains characters that `git checkout` rejects on Windows. Provenance: **Implemented**.

`api_log/api_log.txt` is tracked. Contents were not read.

## APIs and integrations

| Piece | Detail | Provenance |
|---|---|---|
| In-app API module | Controllers under `application/modules/api/controllers/`. Action names are in `prd.md`. No view directory | **Implemented** |
| MyMobileAPI | `public/class/sms.php`, class `MyMobileAPI`, URL `http://www.mymobileapi.com/api5/http5.aspx`, types `credits` and `sendparam` | **Implemented**. Username and password are hardcoded and not copied |
| AppWizard | `CronController::senddata_to_Api` POSTs multipart to `https://fsrugby.appwizard.co.za/scripts/AppWiz.dll`, timeout 86400 | **Implemented** |
| MyPass PDF | `CronController::mypass` reads `/pdf/mypass/id/{AAID}` via `file_get_contents` and names the attachment `mypass.pdf` | **Implemented** |
| Mail | `Zend_Mail` in the reset flow. From address `support@footprint.net`. Transport host not set in the ini that was read | **Implemented** for the message. SMTP **Unknown** |
| SparkPost | PHP library under `public/SparkPost/` | **Implemented** as files. No call site was confirmed |
| RDS MSSQL | `mssql.php` calls `mssql_connect` to `footprintdb.cunkmhm0dyjb.eu-west-1.rds.amazonaws.com:1433` | **Implemented** as a script |
| BokSmart MSSQL | `boksmartmssql.php` connects to `41.164.24.180:52111` and queries `Officials` and `Courses` | **Implemented** as a script |
| Font Awesome | Layout links to cdnjs, version 4.7.0 | **Implemented** |

The `mssql_*` functions were removed from PHP after the 7.0 era. Whether the host that ran this app in 2019 still has that extension is **Unknown**.

## Background work

There is no queue worker, `crontab` file, or `bitbucket-pipelines.yml`. HTTP actions on `CronController` are the only scheduler surface found. One of them redirects the browser to `https://footprintapp.net/cron/autoruntoo`. Provenance: **Implemented**. What calls that URL on a timer is **Unknown**.

## Storage

Accreditation and image trees are inside the Git commit, not behind an object-store client. No S3 or Azure storage SDK was identified in the files read. `UPLOADS_PATH` points at `public/uploads`, which was not in the grouped top level of `public/`. Provenance: **Implemented** as a constant. Whether the directory exists in the tree is easy to miss in a grouped listing. A direct `git ls-tree` name search for `public/uploads` was not a separate command. **Unknown** if that directory is empty or absent.

## Build, environments, and deployment

No Dockerfile, Compose file, Makefile, application `composer.json`, or pipeline file is in the application root. phpMyAdmin, Dompdf, and TCPDF ship their own `composer.json` files. Those are upstream packages.

`staging` does not override the database host. All ini sections share `localhost` unless the copy ini files differ. Those copies were not opened.

How Apache, the virtual host, and TLS were installed is **Unknown / Requires Confirmation**. The slug and the layout strings use the hostname shape `footprintapp.net`. The rewrite file would fit a document root at the repository root, with PHP files also reachable at `/phpinfo.php` and `/phpMyAdmin/`.

The commit machine name `ip-10-0-2-5.eu-west-1.compute.internal` is an EC2 internal hostname. It identifies where the snapshot was committed. It does not by itself prove the runtime region in 2026.

## Testing

No application PHPUnit suite, fixture database, or CI config was found. `library/Zend/Test/PHPUnit/` is the framework's own test support. phpMyAdmin vendor packages contain their own `phpunit.xml` files. Provenance: **Implemented** as those paths. There is nothing in this repository to execute as a Footprint test run.

Controllers named `TestController`, `MytestController`, and `*test*` are application code left on `master`, not an automated suite.

## Security notes (observed, not a pentest)

These are facts about the tree. They are not instructions for using the weaknesses.

- Database passwords are stored in `application.ini`. A further username and password sit in the commented bootstrap.
- `public/class/sms.php` hardcodes an API username and password.
- `mssql.php` and `boksmartmssql.php` hardcode database passwords and print connection results.
- `LoginController` accepts one fixed password and then authenticates as the profile's stored password.
- `indexoldAction` builds a SQL predicate by concatenating the email request parameter (`Username ='" . $data["Email"] . "'`).
- `phpinfo.php` is excluded from the rewrite into `public/`.
- phpMyAdmin is tracked at the repository root and is also excluded from that rewrite.
- `.gitignore` is not in the root listing from `git ls-tree`. Secrets and the accreditation archive are in the commit.
- Production config turns display_errors off. Development turns them on.

Credential values are omitted on purpose. They should be treated as exposed, because they are in Git history that cannot be rewritten by deleting a later commit: this commit is the only commit.

## Development process visible in the tree

`changelog.txt` is a short hand log (13/05/2019 and 17/05/2019, initials HDP) naming two controller methods. There is no issue tracker, branch model, or code-review trail inside the repository. The dump author is `root` on an EC2 instance, not the HDP initials. Provenance: **Documented** for the changelog, **Implemented** for the commit metadata.

## Git metadata

| Field | Value |
|---|---|
| Default branch | `master` (`origin/HEAD`) |
| Tip | `593bd151015e4d8d264ba5518ecf172368135711` |
| Author | `root <root@ip-10-0-2-5.eu-west-1.compute.internal>` |
| Author date | 2019-09-06 09:05:47 +0000 |
| Commit message | `Initial Commit` |
| Parents | none |
| Other branches / tags | none |

## Related repositories

| Repository | Relationship as evidenced | Provenance |
|---|---|---|
| `footprintlive.git` | Separate remote. Silicon Ark docs also name database `teamwizz_SARU` and a Zend 1 Footprint menu | **Unknown** whether the code matches. Not diffed |
| `footprint-not-used.git` | Separate remote. README heading only. Commit `76b2c93` by Jaco Brits on 2019-05-22 | Not this tree |
| `footprint-lambda.git` | `.gitignore` only | Not this tree |

## Human confirmation

- Live virtual host, PHP version, and whether `mssql` is still available.
- Whether `localhost` in the ini is the application server or a tunnel.
- SMTP host for `Zend_Mail`.
- Whether `union_old` is still routed by any bookmark.
- Whether accreditation blobs should remain in Git.
- Rotation of every secret named above, without committing the new values into a later public dump.
- A diff against `footprintlive.git` if the two trees are supposed to be one product.