When managing an Article in the administrator/backend, it is possible to insert a non-url into the "Intro Image" field (located in the "Images and Links" tab).

enter image description here

Upon clicking "Select" a modal window containing a text input field labeled "Image URL" (among other options) appears. This field expects a url string like images/abc.jpg, but there is no validation on the text in the field so a non-url value can be submitted. I want to eliminate the possibility of a non-url value like html, javascript, etc. from being stored. e.g. <img src="xxx/yy/zbx.jpg" onmouseover="alert(xxxx)" />

enter image description here

Ideally, I wish to deny the submission from the modal, so that the parent form can not receive the non-url value and generate the following:

enter image description here

Ultimately I'd like to validate the url field when saving the Article.

  • 1
    @mickmackusa: When there is an unclear or other problematic question, use the available tools to mark it - e.g send it to the review queue - so more users will review it. During the review period the OP might edit his question. If not it will be in track for the community to moderate it, otherwise it can stay forgotten.
    – FFrewin
    Commented Oct 18, 2018 at 4:31
  • @mohan - Your question is on hold as unclear. Feel free to edit and clarify as best as you can what your question is about.
    – FFrewin
    Commented Oct 18, 2018 at 4:34
  • 1
    @FFrewin I think I understand the question now and can replicate the issue. I've performed a heavy-handed edit and voted to Reopen. Commented Oct 18, 2018 at 6:26
  • @mohan let's move this question forward. Did one of the answers solve your issue? If so, please award the green tick. If not, please state what is left to fix. Commented Feb 2, 2019 at 9:07

2 Answers 2


To prevent invalid values from being passed to the parent window, you can create an override of mediafield.js (and minified mediafield.min.js) which is located in /media/media/js/ folder.

Add your filtering/validation here:

        // bind insert
        content.on('click', self.options.buttonSaveSelected, function(){
            var value = content.find('#f_url').val();
            if (value) {

This snippet should strip out HTML from value (source).

            var tmp = document.createElement("div");
            tmp.innerHTML = value;
            value = tmp.textContent || tmp.innerText || "";

To prevent invalid values from being saved to database, no action should be needed as by default HTML is filtered out from the field. But if you want to change the filter, create a content plugin with onContentPrepareForm event and set the filter of the field there:

public function onContentPrepareForm($form, $data)
    if ($form->getName() !== 'com_content.article')
        return true;

    $form->setFieldAttribute('image_intro', 'filter', 'SOMEFILTER', 'images');

Make an override of administrator > components > com_content > models > article.php

Inside that override, find this function (line 549 in article.php):

if (isset($data['images']) && is_array($data['images']))
    $registry = new Registry($data['images']);

    $data['images'] = (string) $registry;

Add this before $registry inside the function:

$imgToCheck = $data['images']['image_intro'];
$application = JFactory::getApplication();
if (preg_match('~^[a-z0-9/.-]+$~i', $imgToCheck)) {
    // This is a URL
    $application->enqueueMessage('URL OK');
} else {
    // Not an valid URL
    $application->enqueueMessage(JText::_('Please use a valid URL'), 'Invalid URL');

This will test the url input for the intro image.

I'm not really good at preg_match, but this should only allow letters from A-Z and numbers and /and ....You can change this to match your needs.

I hope this will help you! I'm not really expierenced in Joomla myself, but since no one answered this question, I though I would do my best to help.

  • how to add this validation in joomla....?
    – mohan
    Commented Oct 20, 2018 at 5:07
  • @mohan see updated answer Commented Oct 20, 2018 at 17:59
  • thanks. but noting is working. no affect of validation after insert.
    – mohan
    Commented Oct 22, 2018 at 9:06
  • What if you replace $application->enqueueMessage('URL OK'); with die("URL OK"); and $application->enqueueMessage(JText::_('Please use a valid URL'), 'Invalid URL'); with die("not ok"); ? Commented Oct 22, 2018 at 13:41
  • If nothing comes up, then your override may not work. Or you are not using the "intro image" field Commented Oct 22, 2018 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.