I am presently the only software developer at my company. A while ago, our company hired another company to rewrite one of our FoxPro apps that used a MySQL database backend into a PHP/MySQL based web system using the same database that would run from our local intranet. They were given information including a schema diagram, a PRD, use cases, and a very detailed explanation of how passwords are stored in our database and how to properly test if a login succeeded or not.
I was tasked with getting it up and running on our own IIS web server after they had it up and running on their website. I was given information including a phpinfo() page that described the PHP version and all the extensions that this company used to develop this application, so I set up our web server and PHP installation to have all the same pertinent settings and extensions.
After installing it, there were a number of issues with the product including:
- The login system did not follow our encryption scheme properly and nobody was able to log in. I had to patch code in three different classes for it to work properly. I do not have access to actually push changes to the repository, only fetch them, so I emailed the company the corrected PHP files. After I submitted files to the company that contained the correct login code, further updates pushed still did not include the corrections, and I had to patch them again.
- There are various settings that a user should be able to edit and then press Submit to commit the changes to the database, many of these will do absolutely nothing after pressing Submit, others will appear to commit the changes, but when the page is refreshed, they are lost, yet others will produce PHP errors when pressed.
- Some of the changes that this product required to be made to the database schema broke other applications that I had to recompile.
- Most (I would say about 95%) of the comments in the PHP source code are from the authors of the framework, not the company that designed the application. This means that while I am able to understand what the framework itself does (this is a moot point anyway since it has documentation online), the code written by the company is not easy for me to understand.
The app works properly on this company's test/development web server, and this has given my company the impression that it "should be" working out of the box on ours. I considered that maybe I had made mistakes installing the requisite software on our server but:
- The framework that this company used to design this app is explicitly stated to work with our PHP version
- I have installed other freely available PHP/MySQL-based web apps including WordPress, phpBB and MediaWiki on our web server to test this, and all of them work just fine.
Since the company I work for is not a software development company, and very few staff have much knowledge of computer science, I'm concerned that blame might fall on me for "not setting it up properly". I am also concerned that if management grows a bizarrely misplaced sense of confidence in this company they will hire them for further projects, and the work of having to clean up after them will continue to fall on me. I also think it's ridiculous that I have to patch an application composed of tens of thousands of lines of code that I've never seen before, written specifically for us, with adequate knowledge of how our system works, just to get it to the point that it's even usable on our system, and that it's beyond the extent of my responsibility as a software developer. What should I do?