feat: add admin dashboard and core API routes with Docker configuration

app/api/auth/forgot-password/route.ts

@@ -5,6 +5,15 @@ import crypto from 'crypto';
 
 import { verifyCsrfToken, verifyOrigin } from '@/lib/csrf';
 
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
 export async function POST(req: NextRequest) {
     // CSRF Protection
     const isOriginValid = verifyOrigin(req);
@@ -52,13 +61,14 @@ export async function POST(req: NextRequest) {
       where: { id: 'singleton' }
     });
 
-    const siteName = settings?.siteName || 'Afrohub';
+    const siteName = escapeHtml(settings?.siteName || 'Afrohub');
+    const safeUserName = escapeHtml(user.name || '');
     const subject = settings?.resetPasswordSubject || 'Réinitialisation de votre mot de passe - Afrohub';
     
     let html = settings?.resetPasswordTemplate || `
         <div style="font-family: sans-serif; max-width: 600px; margin: 0 auto; padding: 20px; border: 1px solid #e5e7eb; border-radius: 8px;">
           <h2 style="color: #0d9488; text-align: center;">${siteName}</h2>
-          <p>Bonjour ${user.name},</p>
+          <p>Bonjour ${safeUserName},</p>
           <p>Vous avez demandé la réinitialisation de votre mot de passe. Cliquez sur le bouton ci-dessous pour choisir un nouveau mot de passe :</p>
           <div style="text-align: center; margin: 30px 0;">
             <a href="${resetUrl}" style="background-color: #0d9488; color: white; padding: 12px 24px; text-decoration: none; border-radius: 6px; font-weight: bold;">Réinitialiser mon mot de passe</a>
@@ -71,7 +81,7 @@ export async function POST(req: NextRequest) {
 
     // Replace placeholders
     html = html
-      .replace(/{name}/g, user.name)
+      .replace(/{name}/g, safeUserName)
       .replace(/{resetUrl}/g, resetUrl)
       .replace(/{siteName}/g, siteName);