enable-media-replace plugin incorrectly uses GUID for filename

A client of mine is using this plugin and has had instances when it basically doesn’t work at all, in terms of the replace_and_search functionality.

Let me start with the background:

https://pods.io/2013/07/17/dont-use-the-guid-field-ever-ever-ever/

And on to the problem:

upload.php, line 313 $current_base_url is derived from $current_filename on line 197-198:

$sql = "SELECT guid, post_mime_type FROM $table_name WHERE ID = '" . (int) $_POST["ID"] . "'";
list($current_filename, $current_filetype) = $wpdb->get_row($sql, ARRAY_N);

which is taken directly from guid in the database.

The recommended method for retrieving the URL for a media file is to use wp_get_attachment_url($id) which would be the fix on lines 197-198:

$sql = "SELECT post_mime_type FROM $table_name WHERE ID = '" . (int) $_POST["ID"] . "'";
list($current_filetype) = $wpdb->get_row($sql, ARRAY_N);
$current_filename = wp_get_attachment_url($_POST['ID']);

In short, if your plugin uses the GUID for media file names, it is brittle and will break extremely quickly. Please consider fixing this issue, and I appreciate you putting your hard work into this plugin.

• This topic was modified 6 years, 11 months ago by marketacumen.
• This topic was modified 6 years, 11 months ago by marketacumen.