# Technical documentation — public-quantivia.com

Evidence date: 2026-10-06. Source: `git@bitbucket.org:overdrive/public-quantivia.com.git`, `master` at `9e3c6f2` (2020-08-27, author `root`, "initial commit of full repository").

One branch: `master`. No README, no automated tests, no CI config, no Docker file, and no application database.

Credential values that appear in source are **omitted**. They are in git history and should be treated as exposed.

## What the tree is

A PHP marketing site for www.quantivia.com, imported in one commit. Eclipse project file `.project` names it `www.quantivia.com` and enables the PHP and JavaScript natures (`org.eclipse.php.core.PHPNature`, `org.eclipse.wst.jsdt.core.jsNature`). `.buildpath` is present. No `composer.json` at the repository root. Composer is used only under `mail/`.

The Quantivia product (eGroupWare module, projects, deliverables) is not in this tree. See `silicon_ark/quantivia/` and the related sets named in `project-plan.md`.

## Layout

```text
public-quantivia.com/
├─ index.php, header.php, header_inner.php, footer.php, form.php
├─ demo.php, why_quantivia.php, prices.php, contact.php, support.php
├─ viewdemo.php, download.php, download_thanks.php, thanks.php, status.php
├─ casestudy.php, durban_resignalling_project.php, riyadh_metro_project.php, s_bahn_hamburg.php
├─ explanation.php, inspiration.php, testimonials.php, 404.html
├─ *newsletter.html, sitemap.xml, robots.txt
├─ analyticstracking.php, google4733d946ea073d91.html, BingSiteAuth.xml
├─ index_new.php, new.html, test.html, license.lic, PIE.htc
├─ css/ js/ img/ images/ font/ fonts/ jquery.bxslider/
├─ mail/                  PHPMailer + vendored AWS SDK, used by the root forms
├─ news/                  two articles
├─ website_new/           older page and mail copy
└─ returned/              2015 layout and CSS backups
```

`images/` and `img/` both exist. Root pages that were read use `img/`.

## Runtime

| Item | Evidence | Status |
|---|---|---|
| Language | PHP pages, Eclipse PHP nature | PHP. Minimum version **Unknown** |
| Web server | Not configured in the repo | **Unknown** (Apache/nginx/IIS not stated) |
| Document root | Pages and `sitemap.xml` assume the site root is `/` on quantivia.com | **Inferred** from absolute links |
| Database | No PDO, mysqli, or SQL in the root pages or `mail/lib/mail_sender.php` | None for this site |
| Sessions | No `session_start` in the root application pages that were read | None |
| Background jobs | None | None |
| Tests | None | None |

`mail/lib/mail_sender.php` sets the timezone to UTC in code, after `mail/mail.php` sets `$timeZone` to an empty string. The `$timeZone` variable is not what `date_default_timezone_set` uses.

## Front end

Shared by the root headers:

- `css/themify-icons.css`, `css/bootstrap.css`, `css/flexslider.css`, `css/lightbox.min.css`, `css/ytplayer.css`, `css/theme-red.css`.
- `css/font-awesome.min.css` and `css/custom.css` are commented out.
- Google Fonts stylesheet over **http** (not https): Lato, Raleway, Open Sans.
- Scripts from the footer, all root-relative: jQuery (`js/jquery.min.js`, version string 1.11.1 in the file), Bootstrap, Flexslider, lightbox, Masonry, `twitterfetcher.min.js`, `spectragram.min.js`, YouTube player, countdown, smooth-scroll, parallax, `js/scripts.js?1200`.

`foundry_modal` on the home video modal identifies the theme as Foundry (or a Foundry-derived template). Provenance: **Inferred** from class names, not from a theme README.

`js/scripts.js` is the behaviour layer for forms, countdown widgets, and Mailchimp/Campaign Monitor iframe helpers. The root forms do not use those iframe helpers. They use the email branch.

`PIE.htc` is the CSS3 PIE behaviour file used by old Internet Explorer. No root page that was read links it. `returned/404.html` is in the archive tree beside a copy of the file.

## Request flow for mail

1. `form.form-email` or `form.demo-email` submits in the browser.
2. `validateFields` in `js/scripts.js` checks `.validate-required` and `.validate-email` only.
3. jQuery POSTs `serialize()` plus `url=<location href>` to `mail/mail.php`.
4. `mail/mail.php` sets SMTP settings and includes `mail/lib/mail_sender.php`.
5. The sender loads `mail/vendor/autoload.php` and `PHPMailerAutoload.php`, builds a body from `$_POST`, and sends with PHPMailer SMTP.
6. The script `echo`s the result of `send()` and `exit`s. The Swift Mailer block below `exit` does not run.
7. For `form.demo-email` only, a numeric response replaces `window.location` with the demo URL.

`$emailMethod` in `mail/mail.php` is the string `ses-smtp`. The comment above it says the options are `smtp` and `phpmail`. The sender never reads `$emailMethod`. It always constructs an SMTP PHPMailer. Provenance: **Implemented**.

SMTP parameters that are safe to record:

| Setting | Value in `mail/mail.php` |
|---|---|
| Host | `email-smtp.eu-west-1.amazonaws.com` |
| Port | `587` |
| Security | `tls` |
| To | info@quantivia.com, alastair.davidson@procon8.com |
| Subject | Quantivia Project Management Website Request |
| Extra header | `X-SES-CONFIGURATION-SET: ConfigSet_www_quantivia_com` |
| Username and password | Present as PHP string literals. **Not copied into this document** |

`mail/composer.json` requires `phpmailer/phpmailer` `~5.2` and `aws/aws-sdk-php` `2.*`. The SDK tree under `mail/vendor/aws/` is not referenced by `mail_sender.php`. PHPMailer talks to SES over SMTP.

Commented SMTP secrets in `mail_sender.php` (an older username) are also omitted.

### Older mail copy

`website_new/mail/mail.php` sets `$emailMethod` to `smtp`, host `www.procon8.co.za`, port `25`, security `null`, recipient `info@quantivia.com`, recipient display name `John Doe`, subject `A message from Your Website`. Account username is set; password handling in that file includes a commented account. Values omitted. `website_new/mail/lib/` is Swift Mailer, not the root PHPMailer sender. Root pages do not include this directory.

## Other integrations

| Integration | Where | Notes |
|---|---|---|
| Cotomo | `download.php` action `http://send.cotomo.com/subscribe` | Hidden `list` value `DwvWej120xMqsls0AYn6Xw`. Plain HTML form |
| Demo host | `js/scripts.js`, `thanks.php` | `https://demo.quantivia.com/auto_login.php?demo=true` and `?demo=ref` |
| Installer | `download_thanks.php` | `http://www.quantivia.com/Quantivia_Setup.exe` not in git |
| Google Analytics | `analyticstracking.php` | `UA-82505981-3`, `analytics.js` |
| YouTube | `index.php` | iframe `E9wpku9WseE` |
| LinkedIn | `footer.php` | `platform.linkedin.com/in.js`, company `9295426` |
| Pinterest | `inspiration.php` | `assets.pinterest.com/js/pinit.js`, board `https://za.pinterest.com/cotomo/dashboards/` |
| Dashboards | `status.php` | Two `http://156.38.136.112:9090/publishPage.do` iframes. Path shape matches Zoho Analytics published pages. Product name is **Inferred** |
| Google / Bing verification | `google4733d946ea073d91.html`, `BingSiteAuth.xml` | Static proof files |

`js/spectragram.min.js` and `website_new/js/flickr.js` contain Instagram and Flickr client code. No root page that was read initialises them with keys. They are theme leftovers unless a page script calls them. **Unknown** whether any root page does. `footer.php` loads `spectragram.min.js`.

## Security notes (no secret values)

- Amazon SES SMTP credentials are hardcoded in `mail/mail.php` and referenced in `mail/lib/mail_sender.php`. A different commented SMTP secret is in the sender. `website_new/mail/mail.php` contains further account material, including a commented password.
- These files have been in git since the 2020-08-27 import. **Human review: rotate the SES SMTP credentials and any mailbox password that was committed, and remove them from the tree.** This documentation set does not repeat them.
- `mail/mail.php` has no authentication, CSRF check, or rate limit. It emails the raw POST body.
- The mail body is sent with `isHTML(true)` and the POST values are concatenated without `htmlspecialchars`. **Inferred.**
- Reply-To is built from `$_POST['name']` and `$_POST['email']` with no presence check.
- The demo form stores the client IP in a hidden field and then emails it.
- Google Fonts and several outbound links use `http://`.
- `status.php` embeds an external page over HTTP from a raw IP address.
- `robots.txt` does not hide `mail/` or `status.php`.

## Pages with structural defects

| Location | Defect |
|---|---|
| `sitemap.xml` | Lists `why_www.quantivia.php`. File on disk is `why_quantivia.php` |
| `explanation.php` | Links to `casestudy_bombardier.php` and `casestudy_rtp.php`, which are absent |
| `header_inner.php` | The "Why Quantivia" list item is not closed before the "View Live Demo" item. The menu HTML is nested incorrectly |
| `news/contruction_project_management.php` | `include("/header_inner.php")` is an absolute filesystem path. Filename spells "contruction" |
| `news/multi-database.php` | `include("header_inner.php")` resolves inside `news/`, where that file does not exist, unless the server include path adds the web root |
| `viewdemo.php` | Demo fields are not marked required, so client validation does not run |
| `mail/mail.php` | `$emailMethod = 'ses-smtp'` is unused. Swift code after `exit` is dead |
| `form.php` vs the rest of the site | Contact copy says Procon8 |
| Footer vs menu | "View a live demo" in the footer targets `demo.php`, not `viewdemo.php` |

## Configuration and environments

No `.env`, no environment switch, and no separate dev/test/prod config. Hosts and keys are literals.

`website_new/` is the only second configuration, and it is a different generation of the site rather than a deploy stage.

How the site is hosted, which PHP version it runs, and whether HTTPS is terminated in front of it are **Unknown / Requires Confirmation**.

## Development process visible in git

- Single commit on 2020-08-27 by `root`: "initial commit of full repository".
- No branch other than `master`.
- No issue references, no pipeline file, no phpunit config, no editorconfig.
- CSS backup names under `returned/css/` mention Akash and dates in August 2015. That is filename evidence only.

## Related systems (other repositories)

| System | Relationship to this site | Where it is documented |
|---|---|---|
| Quantivia application | Product the pages advertise. Not imported here | `silicon_ark/quantivia/` |
| `demo.quantivia.com` | Redirect target of the live-demo form. `quantivia-clean` is described there as a demo backup for that host and includes `auto_login.php` | `silicon_ark/quantivia-clean/` |
| `quantivia` and `quantiviaLive` trees | Those write-ups say `auto_login.php` is absent | `silicon_ark/quantivia/`, `silicon_ark/quantiviaLive/` |
| `quantivia-svn` | Documents `auto_login.php?demo` for idle `webdemo*` accounts | `silicon_ark/quantivia-svn/` |

This site only stores the URL. It does not implement demo login. Which repository is deployed to `demo.quantivia.com` was not re-verified while reading this tree. **Requires Confirmation.**