Bizarre Issues with CKEditor (404 w/ Link Editor; Log Outs)

[Arcturus]

On our production site (v3.0.123):

We're just about to launch a new website and have had the bizarre issue develop in the past week where editing any existing http-based link (either via the right-click or toolbar within a CKEditor field) is loading a 404 error page within the link editing modal. Meanwhile, editing an https, tel, or mailto protocol link loads the editor without issue. Isolating the 404 frame within the modal shows the URL below. If I manually add an 's' to that address, the editor loads.

https://[domain]/edit/page/link/?id=2481&modal=1&href=http%3A%2F%2Fwww.crhc.ca%2F&class=ctalink - 404
https://[domain]/edit/page/link/?id=2481&modal=1&href=https%3A%2F%2Fwww.crhc.ca%2F&class=ctalink - Loads

Other than the 404 screen, there's no other error message appearing within the admin or the browser console.

The only recent changes we made to the site's configuration were the additions of the Jumplinks and Page Protector modules, although I believe the issue was present prior to their installation. Because I need both of those modules for a fast approaching launch day, I've created a complete 100% copy of the site to explore rolling things back. However,...

On our development site (v3.0.123 - same server, same environment settings, separate user account):

For whatever reason, accessing any admin page with a CKEditor field on this site immediately logs the user out of ProcessWire. You can view the editor page, and all the content loads (although I can't open repeaters), but any action returns the login screen. Everything else on the backend and frontend of the copy is working as expected.

Again, there's no other error message appearing within the admin or the browser console.

 

Any idea on what may be causing either issue, or what I could do to better diagnose them? Debug is set to true on both sites and it's not a browser issue (tested Chrome, Firefox and Opera).

[Arcturus]

Thankfully I was able to resolve my own issues here.

I'm not sure what went wrong with my initial setup on the development server, but I purged the /site/ side and database, and re-started the migration and CKEditor no longer logs me out of the site.

With that resolved, I was quickly able to exonerate Jumplinks and Page Protector of any blame for the http links issue. After some more investigating, I began testing parts of my .htaccess file and quickly found the source of the matter.

...
RewriteCond %{QUERY_STRING} [a-zA-Z0-9_]=http%3A%2F%2F [OR]
...
RewriteRule ^(.*)$ - [F,L]

The condition comes from a set of rules used to block MySQL injections and other forms of query-based attack, and it was unfortunately interfering with how ProcessWire transitions from the CKEditor to its link editing modules. Simply commenting that line out (with a # at the start) fixed the issue on both servers.