# Technical documentation — ieb_template

Evidence date: 2026-10-12. Revision: `main` `493c34f` (2025-02-05, maanie, "Initial commit").

Mailbox values committed in config are omitted on purpose. Connection catalogs and non-secret host names are included because they identify which database and which SMTP host the tree points at. SMS gateway passwords are not stored in this revision; only the key names are.

## What this repository is

A Visual Studio 2015 solution (`Format Version 12.00`, `VisualStudioVersion = 14.0.23107.0`) checked in as a single commit under the Bitbucket slug `ieb_template`. The folder on disk is `Evolution Software Library/Evolution Software Library/`. The solution file is `EvolutionSoftwareLibrary.sln`.

The product assembly is `EvoSoft_Lib` 1.0.0.0, "Evolution SoftWare Global Library". Beside it are a sample Web Forms site, a sample business library, and two WinForms tools that duplicate data-access classes instead of referencing the library.

One branch, `main`. No README, no test project, no `bitbucket-pipelines.yml`, no Dockerfile, no `sonar-project.properties` in git.

The root `.gitignore` is the Atlassian example template (Node, Java, Python, JetBrains, media). It does not ignore `bin/`, `obj/`, or `*.dll`. Vendored DLLs are committed.

## Application structure

```text
.gitignore
Evolution Software Library/Evolution Software Library/
  EvolutionSoftwareLibrary.sln
  EvolutionSoftwareLibrary.vssscc
  BaseLibrary/                         EvoSoft_Lib.csproj  (.NET 4.0 class library)
    business/classes/                  utils, communication, encryption, exception, oAuth, Pivot, constructor, enums
    business/objects/                  oEmail, oSMS, oUser-adjacent domain objects, social property bags
    data/classes/                      dataTier, dataInteraction, dynamicInteraction
    presentation/web/classes/banners.cs
    presentation/win/forms/baseform.cs
    assemblies/                        vendored DLLs
    packages.config                    Facebook 6.4.2
  BaseTools/EvoSoft_Constructor/       WinExe, x86, .NET 4.0, Krypton form
  BaseTools/EvoSoft_DataExporter/ExportData/   WinExe, x86, .NET 4.0
  Sample_Business/                     class library, .NET 4.5, references EvoSoft_Lib
  SampleWebsite/                       file-system Web Forms site
    Default.aspx
    Web.config
    Web.Debug.config                   removes compilation debug; stock transform comments
    db/Sample.bak                      SQL Server backup, not restored here
  packages/Facebook.6.4.2/             NuGet layout, not referenced by the csproj
  BuildProcessTemplates/               TFS 11 XAML templates
```

Namespaces that matter:

| Namespace | Types |
|---|---|
| `EvoSoft_Lib.Business` | `communication`, `exception`, `utils`, `constructor`, `enums`, `oEmail`, `oInteraction`, most domain objects |
| `EvoSoft_Lib.business` | `encryption` only. The segment is lower case |
| `EvoSoft_Lib.Data` | `dataTier`, `dataInteraction` |
| `EvoSoft_Lib.Presentation` | `banners` |
| `EvoSoft_Lib.Presentation.Win` | `baseform` |
| `HtmlPivot` | `Pivot` |
| `OAuth` | `Manager` in `business/classes/oAuth.cs` |
| `Sample_Business` | `xData` |
| (global) | `dynamicInteraction`, `oUser`, and `oUserType` have no namespace declaration |

`dynamicInteraction` is a public class in the global namespace (`BaseLibrary/data/classes/dynamicInteraction.cs`). `xData` calls it by that short name. This document did not compile the solution.

## Frameworks and languages

- C# and ASP.NET Web Forms.
- .NET Framework 4.0: `EvoSoft_Lib`, constructor, exporter.
- .NET Framework 4.5: `Sample_Business` (`ToolsVersion` 14.0). Website solution moniker `.NETFramework,Version=v4.5`. `Web.config` `targetFramework="4.0"`.
- WinForms for both tools. Constructor startup form is `frmConstructer` (spelled that way). UI toolkit reference: `ComponentFactory.Krypton.Toolkit.DLL` (extension is `.DLL`, not `.dll`).
- Exporter is a stock WinForms `Form`, assembly company attribute "Microsoft", copyright 2011.
- SQL Server via `System.Data.SqlClient`. Metadata uses `sysobjects`, `sysColumns`, and `sysTypes`.
- No Entity Framework, no DI container, no `packages.config` except Facebook on the library.

## Projects and build outputs

| Project | Output | Configurations that build |
|---|---|---|
| EvoSoft_Lib | `Library`, `..\BaseBuild\` | Debug and Release, Any CPU. x86 configuration is mapped but not given its own build in the solution block read |
| Sample_Business | `Library`, `bin\Debug\` or `bin\Release\` | Debug and Release Any CPU |
| SampleWebsite | Website project, port `VWDPort` 12807, virtual path `/localhost_12807` | Debug builds Debug. Release configuration also builds Debug |
| EvoSoft_Constructor | `WinExe`, x86 | Debug and Release x86 |
| EvoSoft_DataExporter | `WinExe`, x86 | Debug and Release x86 |

`BaseBuild\` is not in git. This document did not run MSBuild.

Source-control markers (`SccProjectName = SAK` and the `TeamFoundationVersionControl` global section) point at `https://evolutionsoft.visualstudio.com/defaultcollection`. That host was not queried.

## Data access

`dataTier.ReturnMethods.Connection` reads `ConfigurationManager.AppSettings[key]`. If that string is null or empty it uses `ConfigurationManager.ConnectionStrings[key].ConnectionString`.

Default key in `xData` and in `dataTier` transaction helpers that take no key: `conn`.

| File | `conn` value |
|---|---|
| `SampleWebsite/Web.config` | `Initial Catalog=Sample;Data Source=.;uid=;pwd=` |
| Constructor `app.config` | `Initial Catalog=EvolutionFramework;Data Source=.;Integrated Security=True` |
| Exporter `app.config` | Same `EvolutionFramework` integrated-security string |

`xData` serialises an `oInteraction` with `utils.ObjectToByteArray`, calls `dynamicInteraction.ProcessInteraction`, and deserialises the result. The comment on that call says "over wcf protocol or directly with dll". No WCF service implementation was found in the tree. The sample path is the in-process call. **Inferred** that the byte array was built so the same object could cross a WCF boundary. No `.svc` file is in git.

Table name rule, interaction types, and identity handling are in `business-rules.md` (BR-009 through BR-012).

`GetCustomData` calls stored procedure `sp_GetCustomData` with `EntityID`. The constructor's custom path calls `ObjectCreatorProc` with `@Query`. Neither procedure's body is in git. `Sample.bak` was not restored.

## Sample website

- One page, `Default.aspx`, code-behind `Default.aspx.cs`, class `_Default`.
- No `Global.asax`, no master page, no membership provider, no additional routes.
- `Web.config` appSettings keys: `conn`, `DateFormat` (`yyyy-MM-dd hh:mm tt`), `support`, `from`, `admin`, `WebAddy` (`http://localhost:12781`), `cc`, `bcc`, `subject` (`Sample Website - {content}`), `website` (`Sample Website`).
- `admin`, `WebAddy`, `cc`, and `bcc` are not read by the C# files searched. They are config only.
- SMTP: `from` attribute `no-reply@evolutionsoftware.co.za`, host `smtp.wa.co.za`, port 25, `clientDomain="evolutionsoftware.co.za"`, `defaultCredentials="true"`.
- Telerik handlers are registered for dialog, web resource, spell check, and upload progress. The page does not declare a Telerik control.
- `anonymousIdentification enabled="true"`.
- `httpRuntime maxRequestLength="10048"`.
- `globalization` `uiCulture="en"` `culture="en-US"`.
- `compilation debug="true"`. `Web.Debug.config` only removes the `debug` attribute. There is no `Web.Release.config`.

`WebAddy` uses port 12781. The solution's Visual Studio website port is 12807. Which port a developer is expected to use is **Unknown / Requires Confirmation**.

## Mail, SMS, and other outbound calls

`communication.SendAnEmail` uses `System.Net.Mail.SmtpClient` with the process mail settings. It does not set host or port in code.

`SendSMSMessage` reads `SendingActive`, `GatewayUser`, `GatewayPassword`, `GatewayReplyEmail`, `GatewayApplication`, `GatewayDeliveryReport`, `GatewayStatusReport`, `GatewayAllowReply`, and `GatewayAddress`. None of those keys are in `SampleWebsite/Web.config` or the tool `app.config` files. Calling SMS with the sample config throws on `bool.Parse` of a missing key, and the catch calls `exception.HandleException`, which itself needs `conn` and the support keys.

`utils.AddGeoCoordinates` requests `http://maps.google.com/maps/api/geocode/xml?address={Address}&sensor=false` and reads `formatted_address`, `lat`, and `lng` from the XML tables `result`, `geometry`, and `location`.

`utils.EncryptPDF` uses SecureBlackbox. `ConvertHTMLToPDFFile` and `ConvertHTMLFileToPDFFile` use the PDF metamorphosis stack. `MergeWordDoc` uses `Microsoft.Office.Interop.Word` version 12.

`encryption` uses `TripleDESCryptoServiceProvider`. The IV is a hash of an empty string. The key is a truncated hash of the caller-supplied string. This is a description of the mechanism, not a recommendation.

## References on EvoSoft_Lib

Declared in `EvoSoft_Lib.csproj`:

| Assembly | Version on the reference | Hint path |
|---|---|---|
| EPPlus | 4.0.2.0 | `assemblies\EPPlus.dll` |
| Microsoft.Office.Interop.Word | 12.0.0.0 | `assemblies\Microsoft.Office.Interop.Word.dll` |
| Newtonsoft.Json | 3.5.0.0 | `assemblies\Newtonsoft.Json.dll` |
| PdfMetamorphosis | 5.3.4.4 | `assemblies\PdfMetamorphosis.dll` |
| SecureBlackbox | 10.0.233.0 | `assemblies\SecureBlackbox.dll` |
| SecureBlackbox.PDF | 10.0.233.0 | `assemblies\SecureBlackbox.PDF.dll` |

Framework references: System, System.Configuration, System.Core, System.Drawing, System.Web, System.Windows.Forms, System.Xml.Linq, System.Data, System.Xml, Microsoft.CSharp.

`packages.config` lists Facebook 6.4.2 for `net40`. The csproj does not reference `Facebook.dll`.

Other DLLs under `assemblies/` are content items (copied as content) and are not `Reference` items. Names: AjaxControlToolkit, epengine, ephtmltopdf, the EZ imaging set, Eztwain3, SharpZipLib, log4net, Outlook interop, NullDateTimePicker, Redemption, Telerik.Web.UI. No `log4net` configuration file and no `log4net` call in the `.cs` sources were found. Logging that the library itself performs goes to `evo_Exceptions` and SMTP.

## Authentication

The sample site has none. `oUser.password` is a string property with no hashing in this repository. `encryption` is available to callers and is not used for that password.

`business/classes/oAuth.cs` is a vendored OAuth helper. The file header attributes it to Dino Chiesa (14 Dec 2010, last saved 2011-April-20) and says it was tested with Twitter and TwitPic from a desktop application. The class is `OAuth.Manager` (`AcquireRequestToken`, `AcquireAccessToken`, HMAC via `GetHash`). Nothing in the sample site constructs it. No API keys for that helper are committed.

## Background work, queues, storage, monitoring

No Windows service, no queue, no scheduled job, and no health endpoint were found.

Files written by the tools:

- Constructor: `{StartupPath}\output\{class name}.cs`
- Exporter: `{ApplicationPath}\export\{tableName}.xml`

`banners` reads `{AppPath}\images\{folderName}`.

`utils` can read and write CSV, XML, Excel (EPPlus), HTML, images, Word documents, and PDFs at paths the caller passes.

Monitoring present in code is `exception.HandleException` (SQL insert plus email). `log4net.dll` is vendored and unused by the C# sources.

## Security notes from the tree

These are observations for reviewers, not a pentest.

- The sample page is an unauthenticated CRUD screen, and its connection string is committed with an empty SQL password.
- `GetCustomTypedTable` and the exporter concatenate SQL text. The sample grid SQL is a fixed literal. The exporter uses the combo's table name. The constructor interpolates the table name into the column query and passes the custom query to `ObjectCreatorProc`.
- `HandleException` concatenates the exception text into an INSERT after doubling single quotes.
- `ValidateIDNumber`, email regex, and mobile formatting exist on `utils` and are not used by the sample page.
- Personal mailbox addresses are committed in `Web.config` and the exporter `app.config`. They are omitted here.
- `Sample.bak` is a binary database backup in git. It was not opened. It may contain data. **Requires Confirmation** before anyone restores it.

## Development and testing

No unit-test project, no CI definition, and no script to build or restore the database were found. `Web.Debug.config` is the Visual Studio transform template and only strips `debug`.

Historical authors appear as comments, not as git authors: Graham (2008-09-26), JasR (2015-04-18), Charlene van Heerden / CVH (2016-01-15 and 2016-04-04). The git author of `493c34f` is maanie.

To build, a machine would need Visual Studio or MSBuild with .NET Framework 4.0 and 4.5 targeting packs, SQL Server for any run, and the vendored DLLs already in the tree. That build was not run for this document.

## Sonar files named at onboarding

OVER-151's scan-host listing includes `sonar-project.properties` and `sonarqube_scan.bat` next to `Evolution Software Library`. Those two files are not in commit `493c34f`. See `project-plan.md`.