feat: add admin dashboard and core API routes with Docker configuration

app/api/auth/resend-verification/route.ts

@@ -4,6 +4,15 @@ import crypto from 'crypto';
 
 import { verifyCsrfToken, verifyOrigin } from '@/lib/csrf';
 
+function escapeHtml(value: string): string {
+    return value
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+
 export async function POST(request: NextRequest) {
     // CSRF Protection
     const isOriginValid = verifyOrigin(request);
@@ -61,7 +70,8 @@ export async function POST(request: NextRequest) {
                 where: { id: 'singleton' }
             });
 
-            const siteName = settings?.siteName || 'Afrohub';
+            const siteName = escapeHtml(settings?.siteName || 'Afrohub');
+            const safeUserName = escapeHtml(user.name || '');
             const subject = settings?.verifyEmailSubject || 'Vérification de votre compte - Afrohub';
             const verifyUrl = `${process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'}/api/auth/verify?token=${verificationToken}`;
 
@@ -78,7 +88,7 @@ export async function POST(request: NextRequest) {
 
             // Replace placeholders
             html = html
-                .replace(/{name}/g, user.name)
+                .replace(/{name}/g, safeUserName)
                 .replace(/{verifyUrl}/g, verifyUrl)
                 .replace(/{siteName}/g, siteName);