# Technical documentation — sabullion_current_live

Evidence date: 2026-10-05. Source: `git@bitbucket.org:overdrive/sabullion_current_live.git`, `master` at `6cbf6777` (2022-10-01, "initial commit").

The scan-host working copy was not available. Facts below come from Git trees and from files fetched out of that commit. A full working-tree checkout stopped on Windows paths inside Jetpack and other plugins (`Filename too long`). Those plugins are still in the Git tree.

Credential values are omitted. `wp-content/themes/sabullion/config/mailer.php` contains one.

## Repository

| Item | Value |
|---|---|
| Remote | `git@bitbucket.org:overdrive/sabullion_current_live.git` |
| Branch | `master` only (`git ls-remote --heads`, 2026-10-05) |
| Commit | `6cbf6777aa7fcc57daf1f825663882525bb08f42` |
| Author | AzureAD\RachelMogano `<rachel@overdrive.co.za>` |
| Date | 2022-10-01 17:52:13 +0200 |
| Working-tree size reported by Git during checkout | 31410 files (checkout did not finish) |

`.gitignore` is the stock Atlassian sample (node_modules, class files, logs, IDE, media extensions such as mp4). It does not ignore `wp-config.php`, uploads, or `wflogs`. Provenance: **Implemented**.

## Application shape

WordPress 6.0.2 (`$wp_version` in `wp-includes/version.php`).

Directories at the Git root: `wp-admin`, `wp-content`, `wp-includes`. Root blobs: `.gitignore`, `license.txt`.

Not in the commit, and required by a normal WordPress document root:

- `index.php`
- `wp-blog-header.php`
- `wp-load.php`
- `wp-config.php`
- `wp-login.php`
- `wp-cron.php`
- `xmlrpc.php`
- `.htaccess`

Provenance: **Implemented** as an absence. The onboarding scan of the host working copy also lacked those PHP files and added `sonar-project.properties` and `sonarqube_scan.bat`, which are not in Git.

`wp-config.php` is the usual place WordPress reads `DB_NAME`, table prefix, salts, and `WPLANG`. None of that is in this commit. Provenance: **Unknown**.

## Themes

### `wp-content/themes/sabullion`

Sage 8 theme (`package.json` version 8.5.2, `composer.json` name `roots/sage`, PHP `>=5.4.0`, dependency `phpmailer/phpmailer` `^6.1`). Theme header version 1.2, name Rocket Theme, author Grant Barnard, URI `https://bitbucket.org/mustardmarketing/rocket-theme/src/master/`.

`functions.php` loads the Sage library and then a long WooCommerce customisation (see the PRD). It does not itself include `config/site.php`. `sab-api` gold code does include that file. Other calculator files that `require` it were not all opened. Provenance: **Implemented** for `gold/index.php`.

`lib/setup.php` (namespace `Roots\Sage\Setup`):

- Soil feature flags: `soil-clean-up`, `soil-nav-walker`, `soil-nice-search`, `soil-jquery-cdn`, `soil-relative-urls`. The Soil plugin is not in `wp-content/plugins`. The flags do nothing unless that plugin is present. Provenance: **Implemented** flags, plugin **absent** from this tree.
- Text domain `sage`.
- Menu `primary_navigation`.
- Post thumbnails, post formats, HTML5 support.
- Sidebars `sidebar-primary` and `sidebar-footer`.
- `display_sidebar()` is false for 404, front page, pages, singles, archives, home, and `template-custom.php`.
- Enqueues `styles/main.css` and `scripts/main.js` through the Sage asset helper.

The theme README still tells a developer to install gulp, Bower, and Bootstrap and to branch from the Mustard Bitbucket. That is starter documentation. Provenance: **Documented** in the theme README. It is not evidence of an Overdrive build pipeline. No root CI file exists. The theme `.travis.yml` is the Sage file. Its last run is **Unknown**.

`config/site.php` defines path constants (`ROOT` = `ABSPATH`, `CONFIG`, `HELPERS`, `TEMPLATES`, investing and savings paths) and then includes `dbconnect.php` and queries VAT.

`config/dbconnect.php` opens two PDO MySQL connections, `$SA` and `$DBH`, from constants `DB_ACCESS_*` and `DB_WEB_*`. Those `define()` calls are not in the theme or in `sab-api`. Provenance: **Implemented** reads. Definition site **Unknown / Requires Confirmation**.

`config/mailer.php` builds a PHPMailer instance. Default: SMTP to `smtp.office365.com` port 587, TLS, authentication as `business@sabullion.co.za`. `lamp`: `isSendMail()`. Peer verification is disabled on the default branch.

### `wp-content/themes/sabullion-child`

`Template: sabullion`. Enqueues parent and child stylesheets and `js/functions.js`. Calls `session_start()` at file scope. WooCommerce template overrides under `woocommerce/cart`, `woocommerce/myaccount`, `woocommerce/order`, and `woocommerce/templates/checkout`.

Also present and unused by the template loader: `woocommerce/cart/cart.php2000`.

### Other themes

`twentytwenty`, `twentytwentyone`, `twentytwentytwo`. Stock WordPress themes. Provenance: **Implemented**.

## Custom plugin `sab-api`

File: `wp-content/plugins/sab-api/sab-api.php`.

WordPress REST namespace `api/v1`. Routes are listed in the PRD. Each `permission_callback` returns true.

`sab_api_scripts` enqueues CSS and SweetAlert on every front-end request, and calculator scripts when `is_page()` matches a slug list (PRD WF-006).

Included PHP (relative to the plugin):

- `api/gold/alt.php`, `api/gold/index.php`
- `api/calc/index.php`, `silver-index.php`, `minted-bar-index.php`
- `api/altcalc/index.php`
- `api/email/index.php`, `silver-index.php`, `minted-bar-email.php`
- `api/upload/` buy, sell, savings, investment, and shop customer-file scripts
- `api/create/ajaxfunctions.php`

Vendored inside the plugin, not as WordPress plugins: PHPExcel, PHPMailer, mPDF, and a directory named `mpdf_new_version_donotuse`. Generated PDFs are stored under `api/pdf/` (many `*.pdf` blobs are in Git). Provenance: **Implemented**.

`api/login/` and `api/signup/` exist in the tree. `sab-api.php` does not `require` them in the block that was read. Whether another file includes them is **Unknown**.

Gold query: table `gold_price` on `$SA`, columns observed in code `Date` / `date`, `ZAR`, `USD`, `EUR`, `GBP`, plus a column name taken from the `currency` query parameter. The parameter is concatenated into the SQL text. Provenance: **Implemented**. That is an injection surface.

VAT query: `SELECT dblVat from sysVat` on `$SA`.

## Third-party plugins

The inventory and versions are in `features.md`. They are files on disk. WordPress loads a plugin only when `active_plugins` (or the network equivalent) says so. That option is not in Git.

Notable tree facts:

- `woo-eftsecure-gateway` is a zero-byte file.
- `woocommerce-payments` has `readme.txt` (stable tag 4.4.0), `templates/`, `vendor/`, and `apple-developer-merchantid-domain-association`, and no plugin bootstrap PHP at the directory root. Provenance: **Implemented**. Whether it can activate is **Unknown**.
- Wordfence 7.6.2 is present and `wp-content/wflogs/` is committed (`config.php`, `config-livewaf.php`, `rules.php`, `attack-data.php`, `ips.php`, GeoLite `GeoLite2-Country.mmdb`). Those files were not opened and their values are not copied here. Committing WAF config and attack data is what the tree does.

## Data

No migration or schema file is in the repository. Tables named by code that was read:

| Name | Connection | Use |
|---|---|---|
| `sysVat` | `$SA` | Column `dblVat` |
| `gold_price` | `$SA` | Latest row or a date range. Currency columns include ZAR, USD, EUR, GBP |

WordPress and WooCommerce tables are implied by core and were not dumped.

`$DBH` is opened and described in a comment as the web database. A full call-site list was not built. Provenance: connection **Implemented**, consumers **not fully traced**.

Uploads from 2016 through 2022 are in Git under `wp-content/uploads/`. Provenance: **Implemented** as directories.

## Auth

- Shopper auth is WordPress / WooCommerce (`wp-login` via My Account templates in the child theme).
- No custom role registration was found.
- `sab-api` REST routes do not require a cookie or an application password.
- Shortcodes `[show_loggedin_as]` and `[show_id_loggedin_as]` echo the current user's id, name, and email into hidden inputs.
- SMTP and the two PDO passwords are outside WordPress's option API. The SMTP password is hardcoded. The PDO passwords are whatever the missing constants hold.

Provenance: **Implemented**.

## Background work, queues, cron

No project cron, queue worker, or `wp-cron` event registration was found in the theme `functions.php` or `sab-api.php` sections that were read. WordPress core and several plugins ship their own scheduled events. Which of those run is **Unknown**.

Order Delivery Date, BackUpWordPress, and Wordfence can schedule work when active. Activation is **Unknown**.

## HTTP surface added by this project

Base path is the WordPress REST prefix, normally `/wp-json`, which is not confirmed here because permalink structure is an option and `.htaccess` is absent.

Routes: see the table in `prd.md` WF-006. Methods are GET except customer-file and customer-id-file (POST) and `/functions/` (GET and POST).

## Environments

| Signal | Behaviour |
|---|---|
| `SERVER_NAME` `lamp` | sendmail; investment-mail BCC to an Overdrive address |
| `SERVER_NAME` `sabullion.co.za` | coins CC and, for the main investment mail, a Gmail BCC |
| Anything else | Office 365 SMTP |
| Comments only | `dev.overdrive.co.za`, XAMPP. Not branched in current `site.php` |

No `.env`, Docker file, or deploy script is at the repository root.

## Security notes (evidence, not a pentest)

- Office 365 password stored in `config/mailer.php`. Omit from docs. Treat as exposed because it is in Git history.
- SMTP TLS verification disabled.
- PDO errors echo the exception message to the client.
- REST `permission_callback` returns true on upload and email routes.
- `currency` is concatenated into a SQL select list in `gold_index`.
- `wflogs` and generated calculator PDFs are in the repository.
- `destroy_sessions` references an undefined `$user_id`.

No secret values are repeated in this file.

## Development and test process

Not established for the SA Bullion site.

The theme README documents `npm install`, `bower install`, `gulp`, and `gulp watch`, and a BrowserSync `devUrl` in `assets/manifest.json`. That is Sage's process. Provenance: **Documented** in the theme.

No PHPUnit, no Jest config at the repository root, no Bitbucket pipeline file. Provenance: **Implemented** as an absence.

`composer.json` and `package.json` live in the theme, not the repository root.

## Monitoring

- `analyticstracking.php`: Google Analytics `analytics.js`, property `UA-1288630-36`. Inclusion from a template was not confirmed.
- WooCommerce Google Analytics Integration 1.5.14 is vendored. Settings **Unknown**.
- Wordfence files are present. Whether the WAF is installed on the host is **Unknown**.
- No application log library was identified in the custom PHP beyond `error_log` files that are themselves committed under `sab-api/api/` (for example `api/calc/error_log`). Those files were not transcribed.

## Related repository

Silicon Ark `sabullion/` describes `git@bitbucket.org:overdrive/sabullion.git`. This document does not merge the two. The only link found inside this commit is the email URL `https://sabullion.co.za/dashboard/login.php`, which is not a path in `6cbf6777`.

## Human confirmation

- Runtime PHP version, web server, and document root.
- Contents of the real `wp-config.php` and where `DB_ACCESS_*` / `DB_WEB_*` are defined.
- Active theme and active plugins.
- Whether root bootstrap files exist only on the server.
- Whether the Office 365 password has been rotated since this snapshot.
- Whether `sonar-project.properties` and `sonarqube_scan.bat` should be treated as part of the project. They are not in Git.