# Technical documentation — menu.mypass.zone

Evidence date: 2026-10-09. Source: `master` at `ca37151` (2022-07-21).

## Stack

| Item | Value | Evidence |
|---|---|---|
| Language | PHP | `public/index.php`, controllers |
| Framework | Zend Framework 1.11.10, vendored | `library/Zend/Version.php` constant `VERSION` |
| Layout | Zend_Layout, script `application/layouts/default.phtml` | Standard ZF1 module layout. No explicit layout resource in `Bootstrap` |
| Modules | `default` only | `application/modules/default` |
| Database access | `Zend_Db_Table` | Models. Adapter configuration is not in Git |
| Front-end | Server-rendered PHP templates, jQuery 2.1.1, Bootstrap from the Sportsline theme | Layout and `session/menu.phtml` |
| Web server | Apache `httpd` | CodeDeploy hooks `yum install -y httpd` and `service httpd start` |
| OS for deploy | Linux | `appspec.yml` `os: linux` |
| Package manager | None | No `composer.json`, no `package.json` |
| Tests | None in the repository | No PHPUnit configuration outside vendored libraries |

PHP version on the host is **Unknown / Requires Confirmation**.

## Request path

1. Root `.htaccess` rewrites any URI that does not already start with `/public/` to `public/{uri}`.
2. `public/.htaccess` serves real files and directories, otherwise `index.php`.
3. `public/index.php` sets timezone `Africa/Johannesburg`, `display_errors=1`, `APPLICATION_PATH`, and `APPLICATION_ENV` from the environment or `production`.
4. It loads `library/` onto the include path and runs `Zend_Application` with `application/configs/application.ini`.
5. `Bootstrap` does not register a database adapter or a logger. Resources named in the missing ini file are what would configure `Zend_Db` and the front controller.
6. Default module controllers live in `application/modules/default/controllers`.

The repository root `index.php` is an empty file. A request that reaches it does nothing.

A commented block at the top of `public/index.php` would print a maintenance message and `exit` before the framework boots. It is not active.

## Configuration

`.gitignore` contains one rule: `application/configs/application.ini`.

The directory `application/configs` is not in `master`. A clone has no database host, database name, credentials, or `displayExceptions` flag. Provenance: **Implemented** ignore rule. The file's contents are **Unknown**.

No `.env` file is part of the application. Deploy-time AWS settings are Bitbucket pipeline variables read by name in `bitbucket-pipelines.yml`:

- `QA_AWS_ACCESS_KEY_ID`, `QA_AWS_SECRET_ACCESS_KEY`, `QA_AWS_DEFAULT_REGION`, `QA_APPLICATION_NAME`, `QA_DEPLOYMENT_GROUP_NAME`, `QA_S3_BUCKET`
- the same names with the `PROD_` prefix

Those values are not stored in Git.

## Controllers and routes

Zend default routing: `/{controller}/{action}/id/{id}`. No custom router was found in `Bootstrap`.

| Route | Action | Behaviour |
|---|---|---|
| `/` | `IndexController::indexAction` | Venues for `TID = 284` |
| `/session` | `SessionController::indexAction` | Empty action |
| `/session/dates/id/{id}` | `datesAction` | Dates for a venue |
| `/session/menus/id/{id}` | `menusAction` | Sessions on that row's date |
| `/session/menu/id/{id}` | `menuAction` | Items for the session |
| `/session/nutrition/id/{id}` | `nutritionAction` | Fragment, layout disabled |
| unmatched | `ErrorController::errorAction` | 404 or 500 |

`IndexController` and `SessionController` call `error_reporting(E_ALL)` and then `E_ALL ^ E_WARNING`, and set `memory_limit` to `180M`.

## Data

Queries concatenate request values into SQL. The nutrition allergen lookup is the exception: `AID IN(?)` uses a Zend placeholder.

### Tables and views the menu path reads

| Model | `$_name` | What the live methods actually select | Called by |
|---|---|---|---|
| `Model_MenuVenues` | `Menu_Venues` | `FoodSessionVenues_view` | `IndexController` (`getAllByID` only) |
| `Model_TournamentFoodSession` | `Tournament_Foodsessions` | `FoodSession_view` | `SessionController` |
| `Model_FoodSessionItems` | `SessionFood_Items` | `SessionFood_Items` | `menuAction` (`getAll`) |
| `Model_Nutritions` | `Nutritions` | `Nutritions` in `getRow`. `getAll` would use `Nutritions_view` and is not called | `nutritionAction` |
| `Model_Allergens` | `Allergens` | `Allergens` | `nutritionAction` (`getInRange`) |

Columns read by the views: `VID`, `TID`, `Venue`, `Description`, `SmallImage`, `SID`, `Date`, `StartTime`, `EndTime`, `Title`, `Position`, `NID`, `Allergens`, `Image`, `Portion`, `Energy_Cal`, `Energy_Kj`, `Protein`, `Carbs`, `Fat`.

There is no migration directory. Creating these tables is outside this repository. Provenance: **Unknown** where the schema is defined.

### Models present and not used by the menu controllers

`AccreCompanyTypes`, `AccreditationGates`, `AccreditationList`, `AccreditationLoadingServices`, `AccreditationLoadingZones`, `AccreditationPermits`, `AccreVehicleTypes`, `BBEELevel`, `BBEETypes`, `Bluecard`, `ComentryAndCiting`, `CompanyEvents`, `CompanyProfile`, `Copy of Fixture.php`, `Country`, `Ethnicity`, `Fixture`, `FixtureScores`, `GirProfile`, `Logs`, `MatchReport`, `NewsArticles`, `Positions`, `Profile`, `Squad`, `Tournament`, `Unions`, `UserProfile`.

Their `$_name` values include `Fixture`, `squad`, `tournament`, `Accreditation_Permits`, `Companies_Profile`, `Company_Members`, `News_Articles_SA_Rugby`, `BlueCard_Consents`, and `gir_profile`. Provenance: **Inferred** leftover from a broader SA Rugby application. `public/error_log` supports that reading: it is a 2018 log for `TournamentsController` on `/home/sarugby/public_html/`, and that controller is not in this tree.

## Files written at runtime

The menu actions do not write uploads. `public/index.php` defines `UPDATE_PATH` as `public/archives/` and never uses it. `public/archives` exists as a directory in the tree.

`scripts/remove_archives.sh` deletes CodeDeploy deployment directories other than the last successful install. It does not clean `public/archives`.

`public/error_log` is a committed historical log, not evidence of a current logging resource. `ErrorController` logs only if a bootstrap `Log` resource exists, and `Bootstrap` does not create one.

## Mail

No mail transport is referenced by the menu controllers. `library/Other/Functions.php` contains an email-format helper and is not called by those controllers.

## Integrations

### Database

Outbound SQL through `Zend_Db_Table` on each page. Connection parameters: **Unknown**.

### Google Chart QR

`session/menu.phtml` sets an image `src` to `https://chart.googleapis.com/chart` with `chs=300x300`, `cht=qr`, and `chl` set to the URL-encoded string `https://www.sarugby.online/menu/session/menu/id/{SID}/`. The application does not call that API itself. The browser does.

### Theme hosts

The layout loads emoji script configuration aimed at `demo.themeum.com` and font CSS from `http://fonts.googleapis.com`. Stylesheets and jQuery are local under `/wp-content` and `/wp-includes`.

### Deployment

`bitbucket-pipelines.yml` uses image `python:3.5.7`. On branch `qa` or `prod` only, the step exports AWS variables, installs `zip` and `boto3==1.3.0`, zips the working tree to `/tmp/artifact.zip`, and runs `codedeploy_deploy.py`.

`codedeploy_deploy.py` is the Amazon Bitbucket Builds sample (header version 1.0.0). It uploads the zip to `s3://{S3_BUCKET}/{APPLICATION_NAME}/{timestamp}-bitbucket_builds.zip` and creates a CodeDeploy deployment. Failures print the client error and exit non-zero.

`appspec.yml` copies `/` to `/mnt/data/www/html/mypass.zone/menu.mypass.zone/` and sets owner and group `apache`. Hooks, all `runas: root`, timeout 300:

| Hook | Script | What it does |
|---|---|---|
| BeforeInstall | `scripts/install_dependencies` | `yum install -y httpd` |
| ApplicationStop | `scripts/remove_archives.sh` | Removes old CodeDeploy revision directories |
| ApplicationStart | `scripts/start_server` | `service httpd start` |

`scripts/stop_server` is not referenced by `appspec.yml`. Its assignment `isExistApp = \`pgrep httpd\`` includes spaces around `=`, which is not a valid Bash assignment.

Before `ca37151` the destination was `/mnt/data/www/html/footprintapp.net/bluecard.footprintapp.net/`.

The remote that was cloned has `master` only. The pipeline branches `qa` and `prod` are not on that remote. Whether they exist as deployment groups in AWS is **Unknown**.

## Auth model

The request path has no authentication and no authorisation check.

`display_errors` is enabled in the front controller and again in the two content controllers. Combined with string-built SQL, venue, session, and nutrition ids from the query string are passed into queries. This document records that behaviour. It does not describe how to abuse it.

`CompanyProfile.php` selects `Email` and `password` from `CompaniesLogin`. No menu controller constructs that model.

HTTPS redirection in the root `.htaccess` is commented out.

## Front-end assets

The layout is a saved Sportsline theme (Themeum) with WordPress 4.4.5-style asset URLs, WooCommerce CSS references, and a local copy of `wp-includes` jQuery. The menu pages add a Bootstrap modal in `session/menu.phtml`.

Also vendored under `public/` and not used by the menu views: `dompdf` (including its `www` demo scripts), `limitless`, `bootstrap2`, `global_assets`, `dist`, `starters`, `html`, `images`, `fonts`, `files`, `assets`.

`public/178.json` begins with the text `Array` and a timestamp, not a JSON document. `public/209.json` is a JSON log table dated 2018-10-30 for tournament `209`. Neither file is referenced by `application/`.

## Development and testing

No README, no test suite, no CI test step, and no local development instructions are in the repository. The only pipeline steps are the QA and production deploys.

`library/Zend` is the framework. `library/PG` contains a `Controller` directory. `library/Other/Functions.php` and `Notifications.php` are helpers. The menu controllers do not load them.

## Deployment status

Last application commit is 2022-07-21. Whether that revision is what Apache still serves under `menu.mypass.zone` is **Unknown / Requires Confirmation**. The CodeDeploy path is the only deploy target written down.

## Security notes for reviewers

These are observations from the tree, not a test result.

- Database credentials are kept out of Git by `.gitignore`. The configs directory itself is also absent, so a new environment cannot be reproduced from the repository alone.
- `display_errors` is on in code that also defaults `APPLICATION_ENV` to `production`.
- Menu queries build SQL with interpolated ids.
- Item descriptions are echoed as HTML.
- Nutrition, allergens, and menus have no access check.
- `public/dompdf/www` contains executable demo scripts inside the document root. Nothing in the menu application links to them. Whether Apache can still request them is a hosting question. **Unknown / Requires Confirmation**.
- `public/error_log` is committed and is about 378 KB of 2018 notices. No password string was found in a search of that file during this inspection. It still does not belong in a document root.