`, then `include`s `header.php`. `header.php` emits the rest of the head, closes `head`, opens `body`, and prints the nav. The page prints sections. `footer.php` prints the footer and the script tags. `contact.php` sets the title to "Procon8 : Contract Management". That matches a copy of the contract page's title, not the contact heading. ## Languages and libraries | Piece | Version or note | Where | |---|---|---| | PHP | Version not declared. Pages use `include`, `$_POST`, `$_GET` | Root PHP | | jQuery | Minified file, version not labelled in the filename | `js/jquery.min.js` | | Bootstrap | CSS and JS present | `css/bootstrap.css`, `js/bootstrap.min.js` | | Flexslider, lightbox, masonry, parallax, smooth-scroll, ytplayer, countdown, spectragram, twitterfetcher | Theme scripts | `js/` | | Foundry-style theme | Gunmetal theme is the one linked | `css/theme-gunmetal.css` via `header.php`. Other `theme-*.css` files are unused by the pages | | PHPMailer | 5.2.27 (`mail/composer.lock`) | `mail/vendor/phpmailer/phpmailer` | | AWS SDK for PHP | 2.8.31 | `mail/vendor/aws/aws-sdk-php`. Required by Composer. Application code does not construct an AWS client | | Guzzle | 3.9.3 | Pulled in with the AWS SDK | | Symfony EventDispatcher | 2.8.49 | Pulled in with the AWS SDK | | Swift Mailer | Tree under `mail/lib`, not a Composer package | Unreachable send path | `mail/composer.json` requires `aws/aws-sdk-php` `2.*` and `phpmailer/phpmailer` `~5.2`. `mail/vendor` is committed, so a deploy does not need a Composer install unless those files are omitted. Theme comment in the form script refers to Swift Mailer ("always sends back a number"). The live sender is PHPMailer, whose `send()` returns a boolean. PHP prints `true` as `1`, which satisfies that numeric check. ## Request map | URL file | Includes | Notes | |---|---|---| | `index.php` | header, brands, form, footer | Broken `<ul>` around the first slide | | `project.php` | header, companies, form, footer | | | `contract.php` | header, companies, form, footer | | | `specialist.php` | header, companies, form, footer | | | `projects.php` | header, footer | No contact form | | `software.php` | header, footer | No contact form. External images and links | | `about.php` | header, footer | No contact form | | `contact.php` | header, address, send, footer | | | `mail/mail.php` | `lib/mail_sender.php` | POST endpoint used by `js/scripts.js` | | `SLA.php` | none of the current shell | Missing CSS and JS it references | | `quantivia.php` | header, footer | Theme sample | `form.php` is the home and service-page contact section. It includes `address.php` and `send.php`. `contact.php` includes those two files directly and does not include `form.php`. ## Contact mail Settings in `mail/mail.php`: | Setting | Value | |---|---| | `$emailMethod` | `ses-smtp` | | Host | `email-smtp.eu-west-1.amazonaws.com` | | Port | `587` | | Security | `tls` | | To | `info@procon8.com` | | To display name | `Quantivia` | | Subject | `Procon8 Management Website Request` | | SES configuration set | `ConfigSet_www_procon8_com` (set in `mail_sender.php`) | `$emailMethod` is not read. `mail_sender.php` always calls `$mail->isSMTP()` and sends with PHPMailer. Commented Swift Mailer code after `exit` still mentions `smtp` and `phpmail` and would not understand `ses-smtp` either. Credentials: SMTP username and password are PHP string literals in `mail/mail.php`. An older username and password are commented in `mail_sender.php`. This document does not copy the secrets. They are in Git and should be treated as exposed. Rotation is a human action. **Unknown / Requires Confirmation** whether the live SES account still matches these values. From handling: - Both `name` and `email` posted: `setFrom('info@procon8.com', posted name)`. - Otherwise: From is not set. - Reply-To header is concatenated from `$_POST['name']` and `$_POST['email']` with no encoding. - `isHTML(true)` while `Body` is plain text with newlines. `date_default_timezone_set("UTC")` runs in the sender. `$timeZone = 'South Africa'` in `mail.php` is unused, and that string is not a PHP timezone identifier. Client call (`js/scripts.js`, about line 781): POST `mail/mail.php` with serialized fields and `url=<page href>`. Success if the body is numeric and `> 0`. `require 'vendor/autoload.php'` inside `mail/lib/mail_sender.php` is a relative path. PHP resolves it from the include path and the current working directory. The packages live in `mail/vendor`. Whether a given host's working directory makes that require succeed is **Unknown / Requires Confirmation**. ## Data No database configuration, migration, or SQL file exists in the application (vendor tests excluded). Enquiry data exists only inside the outbound message. `cgi/gdform.cgi` and `cgi/gdformssl.cgi` would write every posted field to `data/gdform_<unix time>` one directory above the document root, then redirect to a `redirect` field or to `/`. No page references them. `gdformssl.cgi` follows the same pattern as `gdform.cgi`. ## Authentication and access control Brochure pages: none. `stats/.htaccess`: - `AuthType Basic` - `AuthName "procon8.com Statistics"` - `AuthUserFile /var/chroot/home/content/70/9991770/html/stats/.statspwd` - `Require valid-user` - `DirectoryIndex index.html` `stats/.statspwd` is committed. `stats/index.html` is a GoDaddy placeholder that loads images from `products.secureserver.net`. `stats/.htaccess.bak` is also committed. `SLA.php` reads `$_GET['show']` and concatenates it into a `<script>` block. There is no allow-list. ## Front-end behaviour worth knowing - Image hover swap for the three home service icons is the old `swapImage` / `swapImgRestore` pair in `header.php`. - Accordions use theme classes `accordion accordion-1 one-open`. Behaviour is in `js/scripts.js` (theme), not in application PHP. - Parallax is removed when the user agent matches a mobile pattern in `scripts.js`. - `scripts.js` also contains Disqus, Flickr, Instagram, countdown, and MailChimp helpers. The current pages do not include a Disqus node. The MailChimp path runs only when a form contains an iframe with `srcdoc`, which is `quantivia.php`. - Google Fonts stylesheet is requested over `http://` from `header.php`. ## Assets the shell expects that are missing `SLA.php` references `css/style.css`, `fonts.css`, `js/jq.min.js`, `js/nav.js`, and `js/galleryscript.js`. Those paths are not in the tree. `css/themify-icons.css` and `css/ytplayer.css`, which `header.php` does reference, are present. `images/` exists (used by `SLA.php` for `images/logo.png` and `images/twitticon.png`). The current shell uses `img/`. ## Infrastructure and deployment No Dockerfile, pipeline, deploy script, or environment sample. Evidence that a GoDaddy shared host was used at some point: - `stats/.htaccess` chroot path `/var/chroot/home/content/70/9991770/html/` - `cgi/gdform.cgi` GoDaddy form handler - `stats/index.html` SecureServer imagery The empty root `.htaccess` does not set a rewrite, HTTPS redirect, or PHP version. Where the site is hosted now is **Unknown / Requires Confirmation**. ## Security notes (observed, not a pentest) - SES SMTP secrets are committed in `mail/mail.php` and, as comments, in `mail/lib/mail_sender.php`. - The stats password file is committed. - Contact POST fields are copied into the email body with no escaping. `isHTML(true)` means a posted value can be HTML in the message. - Reply-To is built from POST with no validation, so the mail client can be pointed at an address the visitor did not prove they own. From stays `info@procon8.com` when name and email are both present. - No CAPTCHA and no rate limit on `mail/mail.php`. - `SLA.php` reflects `show` into script. - `disclaimer.html` is not attached to outgoing mail by `mail_sender.php`. ## Development and testing No PHPUnit, no npm, no lint config, no fixture. `mail/vendor` contains upstream library tests. They are not wired to a project test command. Git history cannot show feature-by-feature evolution. One commit imported the tree, author `root`, message "initial commit of full repository". ## Related repositories `public-procon8.co.za` is a separate Bitbucket repository and a separate Silicon Ark directory. It is an older single-page brochure. This `.com` tree is a multi-page theme. Overlap that is visible in files: - Both talk about project control and contract management. - Both can send mail through Amazon SES in `eu-west-1` on port 587. This tree's configuration set header is `ConfigSet_www_procon8_com`. - `SLA.php` iframes a dashboard URL on `www.procon8.co.za:9090`. - Social-disable comments mention both `p8.co.za` and `p8.com`. The Quantivia product site is external (`quantivia.com`). Silicon Ark also has separate `quantivia` documentation directories. Those were not treated as the source for this page. Claims on `software.php` stand as copy in this repository only. ## Unknown / requires confirmation - PHP version and the web server in production. - Whether `mail/vendor` resolves when `mail/mail.php` runs. - Whether the SES configuration set and the stored SMTP user still exist. - Whether GoDaddy is still the host. - Whether `stats/` and `cgi/` are exposed on the public host. - Whether missing `SLA.php` assets are supplied by the server outside this repo.

# Technical documentation — public-procon8.com Evidence date: 2026-10-06. Source revision: `e5cc6be` on `master` (2020-08-27). Remote heads: `master` only. ## What this repository is A PHP brochure. Pages are files. Shared chrome is `include`d. The only server behaviour beyond rendering HTML is `mail/mail.php`, which sends the contact form through PHPMailer to Amazon SES. There is no framework, no router, no database, no queue, no background worker, no test suite, no CI config, and no README. Root `.htaccess` is empty. ## Application structure ```text index.php, about.php, project.php, contract.php, specialist.php, projects.php, software.php, contact.php current pages header.php, footer.php shell form.php, address.php, send.php contact block brands.php, companies.php logo carousel and trust band mail/mail.php mail settings mail/lib/mail_sender.php PHPMailer send mail/vendor/ Composer packages, committed mail/lib/classes/Swift/ Swift Mailer, not on the live path quantivia.php, SLA.php, disclaimer.html present, not in the menu address.php.1 alternate address include cgi/ GoDaddy form CGI, unused by pages stats/ GoDaddy stats stub and basic auth css/, js/, fonts/, img/, images/ theme and media ``` Page pattern: the page file opens `` and ``, sets ``, then `include`s `header.php`. `header.php` emits the rest of the head, closes `head`, opens `body`, and prints the nav. The page prints sections. `footer.php` prints the footer and the script tags. `contact.php` sets the title to "Procon8 : Contract Management". That matches a copy of the contract page's title, not the contact heading. ## Languages and libraries | Piece | Version or note | Where | |---|---|---| | PHP | Version not declared. Pages use `include`, `$_POST`, `$_GET` | Root PHP | | jQuery | Minified file, version not labelled in the filename | `js/jquery.min.js` | | Bootstrap | CSS and JS present | `css/bootstrap.css`, `js/bootstrap.min.js` | | Flexslider, lightbox, masonry, parallax, smooth-scroll, ytplayer, countdown, spectragram, twitterfetcher | Theme scripts | `js/` | | Foundry-style theme | Gunmetal theme is the one linked | `css/theme-gunmetal.css` via `header.php`. Other `theme-*.css` files are unused by the pages | | PHPMailer | 5.2.27 (`mail/composer.lock`) | `mail/vendor/phpmailer/phpmailer` | | AWS SDK for PHP | 2.8.31 | `mail/vendor/aws/aws-sdk-php`. Required by Composer. Application code does not construct an AWS client | | Guzzle | 3.9.3 | Pulled in with the AWS SDK | | Symfony EventDispatcher | 2.8.49 | Pulled in with the AWS SDK | | Swift Mailer | Tree under `mail/lib`, not a Composer package | Unreachable send path | `mail/composer.json` requires `aws/aws-sdk-php` `2.*` and `phpmailer/phpmailer` `~5.2`. `mail/vendor` is committed, so a deploy does not need a Composer install unless those files are omitted. Theme comment in the form script refers to Swift Mailer ("always sends back a number"). The live sender is PHPMailer, whose `send()` returns a boolean. PHP prints `true` as `1`, which satisfies that numeric check. ## Request map | URL file | Includes | Notes | |---|---|---| | `index.php` | header, brands, form, footer | Broken `<ul>` around the first slide | | `project.php` | header, companies, form, footer | | | `contract.php` | header, companies, form, footer | | | `specialist.php` | header, companies, form, footer | | | `projects.php` | header, footer | No contact form | | `software.php` | header, footer | No contact form. External images and links | | `about.php` | header, footer | No contact form | | `contact.php` | header, address, send, footer | | | `mail/mail.php` | `lib/mail_sender.php` | POST endpoint used by `js/scripts.js` | | `SLA.php` | none of the current shell | Missing CSS and JS it references | | `quantivia.php` | header, footer | Theme sample | `form.php` is the home and service-page contact section. It includes `address.php` and `send.php`. `contact.php` includes those two files directly and does not include `form.php`. ## Contact mail Settings in `mail/mail.php`: | Setting | Value | |---|---| | `$emailMethod` | `ses-smtp` | | Host | `email-smtp.eu-west-1.amazonaws.com` | | Port | `587` | | Security | `tls` | | To | `info@procon8.com` | | To display name | `Quantivia` | | Subject | `Procon8 Management Website Request` | | SES configuration set | `ConfigSet_www_procon8_com` (set in `mail_sender.php`) | `$emailMethod` is not read. `mail_sender.php` always calls `$mail->isSMTP()` and sends with PHPMailer. Commented Swift Mailer code after `exit` still mentions `smtp` and `phpmail` and would not understand `ses-smtp` either. Credentials: SMTP username and password are PHP string literals in `mail/mail.php`. An older username and password are commented in `mail_sender.php`. This document does not copy the secrets. They are in Git and should be treated as exposed. Rotation is a human action. **Unknown / Requires Confirmation** whether the live SES account still matches these values. From handling: - Both `name` and `email` posted: `setFrom('info@procon8.com', posted name)`. - Otherwise: From is not set. - Reply-To header is concatenated from `$_POST['name']` and `$_POST['email']` with no encoding. - `isHTML(true)` while `Body` is plain text with newlines. `date_default_timezone_set("UTC")` runs in the sender. `$timeZone = 'South Africa'` in `mail.php` is unused, and that string is not a PHP timezone identifier. Client call (`js/scripts.js`, about line 781): POST `mail/mail.php` with serialized fields and `url=<page href>`. Success if the body is numeric and `> 0`. `require 'vendor/autoload.php'` inside `mail/lib/mail_sender.php` is a relative path. PHP resolves it from the include path and the current working directory. The packages live in `mail/vendor`. Whether a given host's working directory makes that require succeed is **Unknown / Requires Confirmation**. ## Data No database configuration, migration, or SQL file exists in the application (vendor tests excluded). Enquiry data exists only inside the outbound message. `cgi/gdform.cgi` and `cgi/gdformssl.cgi` would write every posted field to `data/gdform_<unix time>` one directory above the document root, then redirect to a `redirect` field or to `/`. No page references them. `gdformssl.cgi` follows the same pattern as `gdform.cgi`. ## Authentication and access control Brochure pages: none. `stats/.htaccess`: - `AuthType Basic` - `AuthName "procon8.com Statistics"` - `AuthUserFile /var/chroot/home/content/70/9991770/html/stats/.statspwd` - `Require valid-user` - `DirectoryIndex index.html` `stats/.statspwd` is committed. `stats/index.html` is a GoDaddy placeholder that loads images from `products.secureserver.net`. `stats/.htaccess.bak` is also committed. `SLA.php` reads `$_GET['show']` and concatenates it into a `<script>` block. There is no allow-list. ## Front-end behaviour worth knowing - Image hover swap for the three home service icons is the old `swapImage` / `swapImgRestore` pair in `header.php`. - Accordions use theme classes `accordion accordion-1 one-open`. Behaviour is in `js/scripts.js` (theme), not in application PHP. - Parallax is removed when the user agent matches a mobile pattern in `scripts.js`. - `scripts.js` also contains Disqus, Flickr, Instagram, countdown, and MailChimp helpers. The current pages do not include a Disqus node. The MailChimp path runs only when a form contains an iframe with `srcdoc`, which is `quantivia.php`. - Google Fonts stylesheet is requested over `http://` from `header.php`. ## Assets the shell expects that are missing `SLA.php` references `css/style.css`, `fonts.css`, `js/jq.min.js`, `js/nav.js`, and `js/galleryscript.js`. Those paths are not in the tree. `css/themify-icons.css` and `css/ytplayer.css`, which `header.php` does reference, are present. `images/` exists (used by `SLA.php` for `images/logo.png` and `images/twitticon.png`). The current shell uses `img/`. ## Infrastructure and deployment No Dockerfile, pipeline, deploy script, or environment sample. Evidence that a GoDaddy shared host was used at some point: - `stats/.htaccess` chroot path `/var/chroot/home/content/70/9991770/html/` - `cgi/gdform.cgi` GoDaddy form handler - `stats/index.html` SecureServer imagery The empty root `.htaccess` does not set a rewrite, HTTPS redirect, or PHP version. Where the site is hosted now is **Unknown / Requires Confirmation**. ## Security notes (observed, not a pentest) - SES SMTP secrets are committed in `mail/mail.php` and, as comments, in `mail/lib/mail_sender.php`. - The stats password file is committed. - Contact POST fields are copied into the email body with no escaping. `isHTML(true)` means a posted value can be HTML in the message. - Reply-To is built from POST with no validation, so the mail client can be pointed at an address the visitor did not prove they own. From stays `info@procon8.com` when name and email are both present. - No CAPTCHA and no rate limit on `mail/mail.php`. - `SLA.php` reflects `show` into script. - `disclaimer.html` is not attached to outgoing mail by `mail_sender.php`. ## Development and testing No PHPUnit, no npm, no lint config, no fixture. `mail/vendor` contains upstream library tests. They are not wired to a project test command. Git history cannot show feature-by-feature evolution. One commit imported the tree, author `root`, message "initial commit of full repository". ## Related repositories `public-procon8.co.za` is a separate Bitbucket repository and a separate Silicon Ark directory. It is an older single-page brochure. This `.com` tree is a multi-page theme. Overlap that is visible in files: - Both talk about project control and contract management. - Both can send mail through Amazon SES in `eu-west-1` on port 587. This tree's configuration set header is `ConfigSet_www_procon8_com`. - `SLA.php` iframes a dashboard URL on `www.procon8.co.za:9090`. - Social-disable comments mention both `p8.co.za` and `p8.com`. The Quantivia product site is external (`quantivia.com`). Silicon Ark also has separate `quantivia` documentation directories. Those were not treated as the source for this page. Claims on `software.php` stand as copy in this repository only. ## Unknown / requires confirmation - PHP version and the web server in production. - Whether `mail/vendor` resolves when `mail/mail.php` runs. - Whether the SES configuration set and the stored SMTP user still exist. - Whether GoDaddy is still the host. - Whether `stats/` and `cgi/` are exposed on the public host. - Whether missing `SLA.php` assets are supplied by the server outside this repo.