Allow enabling smarty escape by default with Smarty5

smarty5/EscapeModifierCompilerOverride.php

@@ -0,0 +1,25 @@
+<?php
+
+use Smarty\Exception;
+use Smarty\Compile\Modifier\EscapeModifierCompiler;
+
+/**
+ * Smarty escape modifier plugin
+ * Type:     modifier
+ * Name:     escape
+ * Purpose:  escape string for output
+ *
+ * @author Rodney Rehm
+ */
+
+class EscapeModifierCompilerOverride extends EscapeModifierCompiler {
+  public function compile($params, \Smarty\Compiler\Template $compiler) {
+    $esc_type = $this->literal_compiler_param($params, 1, 'html');
+    if ($esc_type !== 'htmlall'
+    ) {
+      return parent::compile($params, $compiler);
+    }
+    return 'CRM_Core_Smarty::escape((string)' . $params[0] . ', "htmlall")';
+  }
+
+}

smarty5/EscapeOverrideExtension.php

@@ -0,0 +1,16 @@
+<?php
+
+  use Smarty\Extension\Base;
+
+   class EscapeOverrideExtension extends Base {
+
+  public function getModifierCompiler(string $modifier): ?\Smarty\Compile\Modifier\ModifierCompilerInterface {
+    require_once 'EscapeModifierCompilerOverride.php';
+    switch ($modifier) {
+      case 'escape': return new EscapeModifierCompilerOverride();
+    }
+
+    return NULL;
+  }
+
+}

smarty5/Smarty.php

@@ -9,6 +9,17 @@ class Smarty {
 
   public function __construct() {
     $this->smarty = new Smarty\Smarty();
+    if (CRM_Utils_Constant::value('CIVICRM_SMARTY_DEFAULT_ESCAPE')) {
+      // See https://smarty-php.github.io/smarty/stable/api/extending/extensions/#writing-your-own-extension
+      require_once 'EscapeOverrideExtension.php';
+      $this->smarty->setExtensions([
+        new Smarty\Extension\CoreExtension(),
+        new EscapeOverrideExtension(),
+        new Smarty\Extension\DefaultExtension(),
+        new Smarty\Extension\BCPluginsAdapter($this->smarty),
+      ]);
+      $this->smarty->addDefaultModifiers( ['escape:"htmlall"']);
+    }
   }
 
   public function __call($name, $arguments) {