awkawbandClaude Sonnet 5 e2ac57d9c6 Escape adminAccount.username/email before interpolating into the seed INSERT ...

Both fields were spliced directly into a single-quoted SQL string. An
ordinary value containing an apostrophe (e.g. adminAccount.username =
"O'Brien") broke the INSERT's SQL syntax outright, failing
hortusfox-setup on first boot under set -euo pipefail; a crafted value
could inject arbitrary SQL. Escape backslashes and quotes to match
MySQL/MariaDB's default string literal rules.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-09-28 13:19:24 -04:00

..

default.nix

Escape adminAccount.username/email before interpolating into the seed INSERT

2026-09-28 13:19:24 -04:00