# Features — thegsa

Evidence date: 2026-10-01.

Source: `git@bitbucket.org:overdrive/thegsa.git`, `master` at `522705535dc8a80d3676a76d4b3a189dd7a924b4` (2025-11-10).

There is no features document in the source tree. Status below means what the code contains, not a product roadmap. Menu visibility is stored in MySQL and was not readable from git.

## Current features

| Feature | What it does | Source | Status |
|---|---|---|---|
| Login | Username, MD5 password, active flag, cookie | `login.php` | Current |
| Home | Heading "GSA" and the database menu | `index.php`, `include/menu.inc.php` | Current |
| Advertisers | Search, list, edit, delete. Positions, bad payer, VAT, account fields | `advertiser.php`, `include/advertiser.cls.php` | Current |
| Active / prospective filter | Derived from future non-cancelled contract items | `Advertiser::ShowList` | Current |
| Contacts | Name, title, phones, email, subscribe status, one default per company | `contact.php`, `include/contact.cls.php` | Current |
| Contact logs | Discussion, action, follow-up, type, status, contract, magazines | `contactlog.php`, `include/contactlog.cls.php` | Current |
| Contracts | Header, monthly items, duplicate, renew button, free flag, discount | `contract.php`, `include/contract.cls.php`, `include/contractitem.cls.php` | Current |
| Contract items | Position, size, colour, shape, edited amount, skip, cancel, update label, CI number | `ContractItem::Save` | Current |
| Payment interval | Spreads the contract amount onto every Nth item | `tblPaymentType.intInterval` in `ContractItem::Save` | Current |
| Search | Company search; opens the contact panel | `search.php`, `include/search.cls.php` | Current |
| Email page | Same search class as `search.php` | `email.php` | Current. Same controller as search |
| Report console | Fifteen reports, view / export / PDF | `reports.php`, `include/reports/reports.cls.php` | Current |
| Commissions report | Gated by security item id 3 | `salespersonreport.php`, `include/reports/salespersonreport.cls.php` | Current |
| Renewal document | Form, save, delete | `renewaldoc.php`, `include/renewaldoc.cls.php` | Current |
| Renewal PDF | FPDF A4. No login check | `renewalpdf.php`, `include/renewalpdf.cls.php` | Current |
| Users | Name, MD5 password, active, None/View/Full, sales-person links | `user.php`, `include/user.cls.php` | Current |
| Sales people | Code, name, email, cell, fax, branch, active | `salesperson.php`, `include/salesperson.cls.php` | Current |
| Publications | Name, STAR flag, default flag | `magazine.php`, `include/magazine.cls.php` | Current |
| Lookup tables | Branch, colour, shape, size, position, title, statuses, payment type, update label, email template, contact-log type and status, subscribe status | Matching root PHP pages and `include/*.cls.php` | Current |
| Contract XML | Contacts and open contracts for a company, before login | `contract.php` when `arefCompanyID` is set | Current |
| STAR newsletter | Monthly booking email | `cron.daily.php` | Present, hard-stopped |
| Data import | Bulk insert of the core tables | `ximport.php`, `zimport.php` | Present. Login commented out |
| SonarQube scan | Pipeline on branch pattern `{main}` and on pull requests | `bitbucket-pipelines.yml` | Current in the file. Inspected branch is `master` |

## Report features

Each row is a root script opened by the report console. Classes live in `include/reports/`.

| Script | Console label | Notes |
|---|---|---|
| `invoicelist.php` | Invoice List | |
| `adlist.php` | Planning List | |
| `canceled.php` | Cancelled List | |
| `movelist.php` | Move List | |
| `prospectlist.php` | Prospect List | |
| `prospectlistbycontact.php` | Prospect List by Contact | |
| `prospectexportlist.php` | Prospect Export List | |
| `salespersonreport.php` | Commissions | Hidden unless security item 3 allows it. Uses Dompdf via Composer |
| `expiry.php` | Sales Person Expiry Report | |
| `contactreport.php` | Contact Report | |
| `clientspendreport.php` | Client Spend Report | Comment dated 2017-02-15 |
| `incomelistreport.php` | Income List Report | Comment dated 2017-02-15 |
| `followupreport.php` | Followup Report | |
| `summarisedtotals.php` | Summarised Totals | |
| `advertchange.php` | Advert Updates | Console text: prints only for A, excludes SU, SD, NN, NB |

## Completed features

Nothing in git is marked released beyond the footer `v0.0A, 2008`. Dated backup copies sit beside the live files and are not included by the root pages:

- `include/zz-advertiser.cls-20200915.php`, `include/zz-contact.cls-20200915.php`, `include/zz-contract.cls-20200915.php`
- `include/zzcontract.cls.php` (contains `PreviewMail` and `MailContacts`)
- `include/zcontract.cls.php`, `include/zrenewaldoc.cls.php`, `include/zrenewalpdf.cls.php`
- `contract.back.php`
- `login.php20210414`, `login.php20210419`, `include/system.inc.php20210414`
- Dated copies under `include/reports/` from 2020-09-15 and 2021-04-14

Treat these as historical copies, not as a second running application.

## Planned features

No roadmap, ticket, or TODO file describes future work.

Commented code records work that was started and not left active:

- Copying a client's contract positions onto `tblAdvertiserPosition` on contract save. Comment: disabled because GSA did not want to pay for it.
- Browser-side MD5 of the login password (attribute `x`, not `onclick`).
- `settings.php` still points at `include/general/settings.cls.php` and at `checkSecurity` / `NotSufficientSecurityLevel`, which are not in the tree.

These are leftovers, not a schedule.

## In development

No feature branch or in-progress marker was in the inspected `master` snapshot. The only commit in this clone is an online edit of `bitbucket-pipelines.yml` on 2025-11-10.

Comments, not that commit, record a PHP 7.4 pass (2021-04-14) and a PHP 8 pass (2022-09-26).

## Deprecated or removed

| Item | Evidence | Status |
|---|---|---|
| STAR send | `die("site inactive 20180108")` at the top of `cron.daily.php` | Code remains. Send does not run |
| `ajax.php` | Includes `includes/database/sql.inc.php` and calls `mysql_query` | Present. Does not match the `include/` tree or PHP 7+ |
| `settings.php` | Missing class and missing security functions | Present. Will not run as written |
| Contract-list mail methods | Called from `contract.php`, defined on `include/zzcontract.cls.php` only | Call sites remain. Live class does not implement them |
| User delete vs fee structure | Check commented out in `User::Delete` | Not enforced |
| Position sync on contract save | Commented block in `Contract::Save` | Not enforced |

## Not a product feature

- `mysqldumper/` is a bundled MySQLDumper backup UI.
- `htmltopdf2/` is a bundled HTML-to-FPDF library. The sales person report's `html2fpdf` require is commented out; that report loads Composer Dompdf instead.
- `data.thegsa.co.za.zip` and `uploads/` are committed files. Their contents were not opened.
- `Polyclip SCD_VK.pdf` and `include/images/GSA rates 2011.pdf` are committed PDFs.
- `info.php` is a small root file and was not treated as a product screen.