🔒 Restrict demo endpoint access to authorized operators or E2E secret

- 🛡️ Demo URL is publicly reachable, so gate it behind either a logged-in
  operator with the "lhchat"/"use" permission or an anonymous request
  presenting an e2e_secret matching the E2E_SECRET environment variable
- 🔑 Use hash_equals for constant-time secret comparison to prevent timing
  attacks on the shared E2E token
- 🚫 Redirect unauthenticated visitors to the login page and return a
  no-permission response for logged-in users lacking access, preserving
  the previous behavior
- ➕ Whitelist e2e_secret as an allowed uparam and drop the global "use"
  function requirement so the e2e path can be evaluated inside the view

Author: remdex

lhc_web/modules/lhchat/demo.php

@@ -9,6 +9,36 @@
 // Disable online tracking for demo by session cookies
 $_GET['cd'] = 1;
 
+// Demo URL is public. Access is granted either to a logged in operator having the
+// same required permission as before ("lhchat"/"use") or to an anonymous request
+// providing a get parameter matching the E2E_SECRET environment variable.
+$e2eSecret = getenv('E2E_SECRET');
+
+$e2eSecretProvided = isset($_GET['e2e_secret'])
+    ? $_GET['e2e_secret']
+    : (isset($Params['user_parameters_unordered']['e2e_secret']) ? $Params['user_parameters_unordered']['e2e_secret'] : null);
+
+$e2eAccessGranted = ($e2eSecret !== false && $e2eSecret !== '' && $e2eSecretProvided !== null && is_scalar($e2eSecretProvided) && hash_equals((string)$e2eSecret, (string)$e2eSecretProvided));
+
+if ($e2eAccessGranted === false) {
+
+    $currentUser = erLhcoreClassUser::instance();
+
+    if ($currentUser->hasAccessTo('lhchat', array('use'), true) === false) {
+
+        // Not logged in - redirect to the login page just like before
+        if ($currentUser->isLogged() === false) {
+            erLhcoreClassModule::redirect('user/login', '/(r)/' . rawurlencode(base64_encode(self::$currentModuleName . '/' . self::$currentView)));
+            exit;
+        }
+
+        // Logged in, but without the required permission
+        include_once('modules/lhkernel/nopermission.php');
+        $Result['pagelayout'] = 'login';
+        return;
+    }
+}
+
 if ($Params['user_parameters_unordered']['department'] === null) {
 
     $startData = erLhcoreClassModelChatConfig::fetch('start_chat_data');

lhc_web/modules/lhchat/module.php

@@ -579,9 +579,8 @@
 
 $ViewList['demo'] = array (
     'params' => array(),
-    'uparams' => array('sound','id','hash','department','theme','mobile','vid','identifier','inv','survey','priority','operator','leaveamessage','mode','bot','scope','fs','trigger','encrypted','debug'),
+    'uparams' => array('sound','id','hash','department','theme','mobile','vid','identifier','inv','survey','priority','operator','leaveamessage','mode','bot','scope','fs','trigger','encrypted','debug','e2e_secret'),
 	'multiple_arguments' => array('department'),
-    'functions' => array( 'use' ),
 );
 
 $ViewList['chatwidget'] = array (