This is the final non-JS method that finally worked for me:
Step 1: update sitewide option
You can do this several ways. Since setting it is a one-time operation, I opted to update this by visiting https://www.example.com/wp-admin/options.php . I searched for "image_default_link_type" and set it to "none" (the word none, not null), then saved the settings.
Unfortunately, saved usermeta overrides this sitewide setting - so the problem links were continuing to appear at this point.
Step 2: update all users
Many thanks to @Milo for revealing the location this is stored under - usermeta, buried in a query string of options that may appear in any order.
In theory this could be a one-time operation, or if you think users may continually update their defaults, you can set this to run on a hook like wp_dashboard_setup
so every time someone views the dashboard, all users' "urlbutton" options are removed, which causes the site to use the sitewide "image_default_link_type". I opted to go with run-on-dashboard-view.
add_action('wp_dashboard_setup', 'wpse_update_user_defaults');
function wpse_update_user_defaults() {
$users = get_users();
foreach($users as $user) {
// pull current settings
$wpUserSettings = get_user_meta($user->ID, 'wp_user-settings', true);
// if 'wp_user-settings' is present with a 'urlbutton' value
if(!empty($wpUserSettings) && strpos($wpUserSettings, 'urlbutton') !== false) {
// if 'urlbutton' is not the only setting
if(strpos((string)$wpUserSettings, '&') !== false) {
// if there's an & before (may or may not have an & after)
$firstUpdate = preg_replace("/&urlbutton=[^&]*/", '', $wpUserSettings);
// if there's an & after (but not before)
$secondUpdate = preg_replace("/^urlbutton=[^&]*&/", '', $firstUpdate);
// save updated meta
update_user_meta($user->ID, 'wp_user-settings', $secondUpdate);
// if 'urlbutton' is the only setting
} else {
delete_user_meta($user->ID, 'wp_user-settings');
}
}
}
}
After I got this sorted out, I searched for existing posts with the problem by using this query:
SELECT * FROM wp_posts WHERE post_content LIKE "%rel=\"attachment%"
and from there edited all the posts manually to remove the tags.
$prefix . 'user-settings'
, where$prefix
is your table prefix set in wp-config. The settings are all in a sort of querystring, that specific item isurlbutton
. I'm not sure how you're supposed to update it, I know it also gets put into cookie.