Sourcerer uses the options below. Labels and descriptions follow the current English extension language strings. Rows marked as Pro are editable only in the Pro edition; Free either omits the control or keeps its documented fixed value.
System plugin
Options
| Download Key | Please enter your Download Key from the Regular Labs website here. You can find your Download Key under Downloads on the Regular Labs website after logging in. Pro only. |
Security - Default
| Trusted Request User Groups | Select which logged-in user groups may submit Sourcerer tags through website requests, such as URLs and forms, without Sourcerer blocking unverified code on that request. The normal area and code-type settings still determine what is processed. In the Free version, only Super Users are trusted. Warning: Only select groups whose members may submit every code type enabled for unverified content. Pro only. |
| Allow CSS tags | Choose where CSS is allowed. No removes this code type from all Sourcerer tags. Yes allows this code type in verified and unverified content. Only Verified allows this code type only in verified content. Verified content is stored content passed directly to Sourcerer before it is rendered, with enough information to determine who is allowed to edit it. Unverified content is page output whose origin and editing permissions Sourcerer cannot confirm. It may come from another extension or from visitor input. Allowing code in this content can be unsafe, so enable it only when you trust every source that can generate the output. Options: No, Yes, Only Verified |
| Allow JavaScript tags | Choose where JavaScript is allowed. No removes this code type from all Sourcerer tags. Yes allows this code type in verified and unverified content. Only Verified allows this code type only in verified content. Verified content is stored content passed directly to Sourcerer before it is rendered, with enough information to determine who is allowed to edit it. Unverified content is page output whose origin and editing permissions Sourcerer cannot confirm. It may come from another extension or from visitor input. Allowing code in this content can be unsafe, so enable it only when you trust every source that can generate the output. Options: No, Yes, Only Verified |
| Allow PHP tags | Choose where PHP is allowed. No removes this code type from all Sourcerer tags. Yes allows this code type in verified and unverified content. Only Verified allows this code type only in verified content. Verified content is stored content passed directly to Sourcerer before it is rendered, with enough information to determine who is allowed to edit it. Unverified content is page output whose origin and editing permissions Sourcerer cannot confirm. It may come from another extension or from visitor input. Allowing code in this content can be unsafe, so enable it only when you trust every source that can generate the output. Warning: Allowing PHP in unverified content can cause visitor-submitted data to be executed as code. Only use this when every source that can generate page output is trusted. Options: No, Yes, Only Verified |
| Forbidden PHP functions | A comma separated list of direct PHP function calls that are forbidden. Matching is case-insensitive, and the whole PHP block is removed when a match is found. This is an extra safeguard, not a PHP security sandbox. Allowed PHP can access equivalent functionality indirectly. |
| Forbidden (HTML) Tags | A comma separated list of tags that are forbidden. These tags will be stripped, and also any code in between double tags. |
Security - Articles
| Enable in articles | Select whether to enable the use of the Sourcerer syntax in articles. Options: No, Yes Pro only. |
| Security Level | Set the level of security. Sourcerer tags will be stripped from articles whose creator or last modifier is not a member of these groups. Options: Select, Default Pro only. |
| Allow CSS tags | Choose whether this code type is allowed in articles. No removes it. Yes allows it when the article security checks pass. Default follows the matching setting under Security - Default. Global Yes and Only Verified have the same result because article content is verified before this setting is applied. Options: No, Yes, Default Pro only. |
| CSS Security Level | Set the level of security. CSS tags (and the CSS code within) will be stripped from articles whose creator or last modifier is not a member of these groups. If the overall security level is set higher, it will overrule this. Pro only. |
| Allow JavaScript tags | Choose whether this code type is allowed in articles. No removes it. Yes allows it when the article security checks pass. Default follows the matching setting under Security - Default. Global Yes and Only Verified have the same result because article content is verified before this setting is applied. Options: No, Yes, Default Pro only. |
| JavaScript Security Level | Set the level of security. JavaScript tags (and the JavaScript code within) will be stripped from articles whose creator or last modifier is not a member of these groups. If the overall security level is set higher, it will overrule this. Pro only. |
| Allow PHP tags | Choose whether this code type is allowed in articles. No removes it. Yes allows it when the article security checks pass. Default follows the matching setting under Security - Default. Global Yes and Only Verified have the same result because article content is verified before this setting is applied. Options: No, Yes, Default Pro only. |
| PHP Security Level | Set the level of security. PHP tags (and the PHP code within) will be stripped from articles whose creator or last modifier is not a member of these groups. If the overall security level is set higher, it will overrule this. Pro only. |
| Extra Forbidden PHP functions | A comma separated list of PHP functions to add to the forbidden list (see Default settings) Pro only. |
| Extra Forbidden (HTML) Tags | A comma separated list of tags to add to the forbidden list (see Default settings) Pro only. |
Security - Components
| Enable in components | Choose which Sourcerer tags are processed in component output. No disables Sourcerer tags in this area. Yes processes tags in verified and unverified content. Only Verified processes tags only in verified content. Verified content is stored content passed directly to Sourcerer before it is rendered, with enough information to determine who is allowed to edit it. Unverified content is page output whose origin and editing permissions Sourcerer cannot confirm. It may come from another extension or from visitor input. Allowing code in this content can be unsafe, so enable it only when you trust every source that can generate the output. Options: No, Yes, Only Verified Pro only. |
| Disable on Components | Select which components NOT to enable Sourcerer in. This is a list of your installed frontend components. Pro only. |
| Enable | Choose where this code type is allowed in this area. No removes this code type from all Sourcerer tags. Yes allows this code type in verified and unverified content. Only Verified allows this code type only in verified content. Default follows the matching setting under Security - Default. Verified content is stored content passed directly to Sourcerer before it is rendered, with enough information to determine who is allowed to edit it. Unverified content is page output whose origin and editing permissions Sourcerer cannot confirm. It may come from another extension or from visitor input. Allowing code in this content can be unsafe, so enable it only when you trust every source that can generate the output. Options: No, Yes, Only Verified, Default Pro only. |
| Extra Forbidden PHP functions | A comma separated list of PHP functions to add to the forbidden list (see Default settings) Pro only. |
| Extra Forbidden (HTML) Tags | A comma separated list of tags to add to the forbidden list (see Default settings) Pro only. |
| Show Wizard | Options: No, Yes |
Security - Other Areas
| Enable other areas | Choose which Sourcerer tags are processed in modules, the document head and other non-component output. No disables Sourcerer tags in this area. Yes processes tags in verified and unverified content. Only Verified processes tags only in verified content. Verified content is stored content passed directly to Sourcerer before it is rendered, with enough information to determine who is allowed to edit it. Unverified content is page output whose origin and editing permissions Sourcerer cannot confirm. It may come from another extension or from visitor input. Allowing code in this content can be unsafe, so enable it only when you trust every source that can generate the output. Options: No, Yes, Only Verified Pro only. |
| Enable | Choose where this code type is allowed in this area. No removes this code type from all Sourcerer tags. Yes allows this code type in verified and unverified content. Only Verified allows this code type only in verified content. Default follows the matching setting under Security - Default. Verified content is stored content passed directly to Sourcerer before it is rendered, with enough information to determine who is allowed to edit it. Unverified content is page output whose origin and editing permissions Sourcerer cannot confirm. It may come from another extension or from visitor input. Allowing code in this content can be unsafe, so enable it only when you trust every source that can generate the output. Options: No, Yes, Only Verified, Default Pro only. |
| Extra Forbidden PHP functions | A comma separated list of PHP functions to add to the forbidden list (see Default settings) Pro only. |
| Extra Forbidden (HTML) Tags | A comma separated list of tags to add to the forbidden list (see Default settings) Pro only. |
Editor Button Options
| Button Text | Set the text to show in the button. You can use a language string. |
| Enable in frontend | If enabled, it will also be available in the frontend. Options: No, Yes |
| Color Code | Select to have the editor button add colors to the code when inserting it into the editor. Options: No, Yes |
Tag Syntax
| Sourcerer tag word | This defines the word to use as the Sourcerer syntax tag. Default is 'source'. Which means the tags to use are: {source}...{/source} |
| Tag Characters | The surrounding characters of the tag syntax. Note: If you change this, all existing tags will not work anymore. Options: {...}, [...], «...», {{...}}, [[...]], [:...:], [%...%] |
Advanced
| Strip Surrounding Tags | Select to always remove html tags (div, p, span) surrounding the plugin tag. If switched off, the plugin will try to remove tags that break the html structure (like p inside p tags). Options: No, Yes |
| Enable in Head | Select to also handle the Sourcerer tags inside the document head section of the page. If unselected, any Sourcerer tags found in the head will get removed (together with any code inside them). Options: No, Yes |
| Remove from search | Select to remove the Sourcerer tags and content from the search results. Options: No, Yes |
| Handle PHP Errors | If enabled, Sourcerer catches recoverable PHP execution errors and places an explanatory HTML comment in the output instead of allowing the error to break the page. Disable this to let PHP errors propagate during development and debugging. Options: No, Yes |
| Include Path | The path (relative to the root folder) to use when using the file attribute in the tag. |
| Temporary File Folder | Please specify a writable folder to store temporary files. Leave empty to use the Joomla global Temp Folder. |
| Place HTML comments | By default HTML comments are placed around the output of this extension. These comments can help you troubleshoot when you don't get the output you expect. If you prefer to not have these comments in your HTML output, turn this option off. Options: No, Yes |
Editor button
Options
| Download Key | Please enter your Download Key from the Regular Labs website here. You can find your Download Key under Downloads on the Regular Labs website after logging in. Pro only. |