Start autoescaping

admin.php

@@ -242,6 +242,10 @@ class AdminPlugin extends Plugin
     {
         // Only activate admin if we're inside the admin path.
         if ($this->active) {
+
+            // Turn on Twig autoescaping
+            $this->config->set('system.twig.autoescape', true);
+
             if (php_sapi_name() == 'cli-server') {
                 throw new \RuntimeException('The Admin Plugin cannot run on the PHP built-in webserver. It needs Apache, Nginx or another full-featured web server.', 500);
             }

themes/grav/templates/partials/base.html.twig

@@ -19,13 +19,13 @@
 
     {% block stylesheets %}
         {% include 'partials/stylesheets.html.twig' %}
-        {{ assets.css() }}
+        {{ assets.css()|raw }}
     {% endblock %}
 
     {% include 'partials/javascript-config.html.twig' %}
     {% block javascripts %}
         {% include 'partials/javascripts.html.twig' %}
-        {{ assets.js() }}
+        {{ assets.js()|raw }}
     {% endblock %}
 {% endblock %}
 </head>