"Enable Media Replace" Plugin does not update file paths in posts

[jbrule]

I had a user report that the option to update the file path in posts was not working. Upon inspection it appears that certain posts were not being updated.

--This is from the MySQL Query Log. I can see the query to find posts that contain links to the file.

64351 Query	SELECT ID, post_content FROM wp_197_posts WHERE post_content LIKE '%http://issudev1.ooo.edu/charlie/critical-care-imp/files/2014/06/M_2015Q4.pdf%'

6512,6498,6511,6510,6499,7275,7273,7342,5095,6363,5748,5747,5659,5448,5449, 5669,7272,6345,6341,6342,6346,6348,6382,6384,6790,6785,6786,6791,6793,6792, 6919,6912,6907,7162,7163,7164,7179

--UPDATE queries followed but not ALL ids have corresponding update query. Notice 7275,7273,7342,5095,7162,7163,7164,7179 are missing

64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6512
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6498
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6511
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6510
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6499
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6363
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 5748
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 5747
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 5659
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 5448
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 5449
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 5669
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 7272
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6345
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6341
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6342
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6346
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6348
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6382
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6384
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6790
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6785
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6786
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6791
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6793
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6792
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6919
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6912
64351 Query	UPDATE wp_197_posts SET post_content = '...' WHERE ID = 6907

To troubleshoot the define( 'WP_DEBUG_LOG', true ); function was enabled and the output of $sql was written to the log as follows

$sql = $wpdb->prepare(
"UPDATE $table_name SET post_content = '$post_content' WHERE ID = %d;",
$rows["ID"]
);

error_log($sql);

According to the error_log the value of $sql was an emtpy string. There was no error message thrown.

Since it appears the prepare method uses vsprintf function internally I performed a test using the related sprintf function.

A 'Too few arguments' warning was thrown for the post was failed to update (7275,7273,7342,5095) threw a warning.

$test_post_content = sprintf("UPDATE $table_name SET post_content = '$post_content' WHERE ID = %d;",$rows["ID"]);
--> PHP Warning:  sprintf(): Too few arguments

It appears something in the content of some of the posts was causing the vsprinf function to fail and since the function is called with the @ operator the failure was silent.

As an experiment I tried changing up the prepare statement a little bit. This also required removing the addslashes call as the prepare statement performs escaping on passed in arguments.

$sql = $wpdb->prepare(
"UPDATE $table_name SET post_content = %s WHERE ID = %d;",
$post_content,
$rows["ID"]
);

A patch which includes the changes I just described is attached as well as the content for post 5095. I am unsure what in the content is causing the failure. There are no issues updating the post via the WP dashboard.

We are running WP 4.1.11 on PHP 5.3.3