<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[21010] trunk: Theme Customizer: Block non-existent or non-allowed themes, unless the non-allowed theme is the active theme.</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg > ul, #logmsg > ol { margin-left: 0; margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://core.trac.wordpress.org/changeset/21010">21010</a></dd>
<dt>Author</dt> <dd>nacin</dd>
<dt>Date</dt> <dd>2012-06-06 20:34:24 +0000 (Wed, 06 Jun 2012)</dd>
</dl>

<h3>Log Message</h3>
<pre>Theme Customizer: Block non-existent or non-allowed themes, unless the non-allowed theme is the active theme. Support a user having edit_theme_options xor switch_themes. fixes <a href="http://core.trac.wordpress.org/ticket/20852">#20852</a>.</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkwpadminadminheaderphp">trunk/wp-admin/admin-header.php</a></li>
<li><a href="#trunkwpadmincustomizephp">trunk/wp-admin/customize.php</a></li>
<li><a href="#trunkwpadminincludesclasswpthemeslisttablephp">trunk/wp-admin/includes/class-wp-themes-list-table.php</a></li>
<li><a href="#trunkwpadminincludesthemephp">trunk/wp-admin/includes/theme.php</a></li>
<li><a href="#trunkwpadminthemesphp">trunk/wp-admin/themes.php</a></li>
<li><a href="#trunkwpincludesclasswpcustomizemanagerphp">trunk/wp-includes/class-wp-customize-manager.php</a></li>
<li><a href="#trunkwpincludesjscustomizeloaderdevjs">trunk/wp-includes/js/customize-loader.dev.js</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkwpadminadminheaderphp"></a>
<div class="modfile"><h4>Modified: trunk/wp-admin/admin-header.php (21009 => 21010)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-admin/admin-header.php        2012-06-06 16:48:53 UTC (rev 21009)
+++ trunk/wp-admin/admin-header.php        2012-06-06 20:34:24 UTC (rev 21010)
</span><span class="lines">@@ -102,7 +102,7 @@
</span><span class="cx"> &lt;?php
</span><span class="cx"> // If the customize-loader script is enqueued, make sure the customize
</span><span class="cx"> // body classes are correct as early as possible.
</span><del>-if ( wp_script_is( 'customize-loader', 'queue' ) )
</del><ins>+if ( wp_script_is( 'customize-loader', 'queue' ) &amp;&amp; current_user_can( 'edit_theme_options' ) )
</ins><span class="cx">         wp_customize_support_script();
</span><span class="cx"> ?&gt;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkwpadmincustomizephp"></a>
<div class="modfile"><h4>Modified: trunk/wp-admin/customize.php (21009 => 21010)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-admin/customize.php        2012-06-06 16:48:53 UTC (rev 21009)
+++ trunk/wp-admin/customize.php        2012-06-06 20:34:24 UTC (rev 21010)
</span><span class="lines">@@ -13,11 +13,6 @@
</span><span class="cx"> 
</span><span class="cx"> global $wp_scripts, $wp_customize;
</span><span class="cx"> 
</span><del>-wp_reset_vars( array( 'theme' ) );
-
-if ( ! $theme )
-        $theme = get_stylesheet();
-
</del><span class="cx"> $registered = $wp_scripts-&gt;registered;
</span><span class="cx"> $wp_scripts = new WP_Scripts;
</span><span class="cx"> $wp_scripts-&gt;registered = $registered;
</span><span class="lines">@@ -48,7 +43,7 @@
</span><span class="cx"> &lt;/head&gt;
</span><span class="cx"> &lt;body class=&quot;wp-full-overlay&quot;&gt;
</span><span class="cx">         &lt;form id=&quot;customize-controls&quot; class=&quot;wrap wp-full-overlay-sidebar&quot;&gt;
</span><del>-                &lt;?php wp_nonce_field( 'customize_controls' ); ?&gt;
</del><ins>+                &lt;?php wp_nonce_field( 'customize_controls-' . $wp_customize-&gt;get_stylesheet() ); ?&gt;
</ins><span class="cx">                 &lt;div id=&quot;customize-header-actions&quot; class=&quot;wp-full-overlay-header&quot;&gt;
</span><span class="cx">                         &lt;?php
</span><span class="cx">                                 $save_text = $wp_customize-&gt;is_theme_active() ? __( 'Save &amp;amp; Publish' ) : __( 'Save &amp;amp; Activate' );
</span></span></pre></div>
<a id="trunkwpadminincludesclasswpthemeslisttablephp"></a>
<div class="modfile"><h4>Modified: trunk/wp-admin/includes/class-wp-themes-list-table.php (21009 => 21010)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-admin/includes/class-wp-themes-list-table.php        2012-06-06 16:48:53 UTC (rev 21009)
+++ trunk/wp-admin/includes/class-wp-themes-list-table.php        2012-06-06 20:34:24 UTC (rev 21010)
</span><span class="lines">@@ -125,21 +125,25 @@
</span><span class="cx">                         $version    = $theme-&gt;display('Version');
</span><span class="cx">                         $author     = $theme-&gt;display('Author');
</span><span class="cx"> 
</span><del>-                        $activate_link = wp_nonce_url( &quot;themes.php?action=activate&amp;amp;template=&quot; . urlencode( $template ) . &quot;&amp;amp;stylesheet=&quot; . urlencode( $stylesheet ), 'switch-theme_' . $template );
</del><ins>+                        $activate_link = wp_nonce_url( &quot;themes.php?action=activate&amp;amp;template=&quot; . urlencode( $template ) . &quot;&amp;amp;stylesheet=&quot; . urlencode( $stylesheet ), 'switch-theme_' . $stylesheet );
</ins><span class="cx"> 
</span><span class="cx">                         $preview_link = esc_url( add_query_arg(
</span><span class="cx">                                 array( 'preview' =&gt; 1, 'template' =&gt; $template, 'stylesheet' =&gt; $stylesheet, 'preview_iframe' =&gt; true, 'TB_iframe' =&gt; 'true' ),
</span><span class="cx">                                 home_url( '/' ) ) );
</span><span class="cx"> 
</span><span class="cx">                         $actions = array();
</span><del>-                        $actions[] = '&lt;a href=&quot;' . $activate_link . '&quot; class=&quot;activatelink&quot; title=&quot;'
</del><ins>+                        $actions['activate'] = '&lt;a href=&quot;' . $activate_link . '&quot; class=&quot;activatelink&quot; title=&quot;'
</ins><span class="cx">                                 . esc_attr( sprintf( __( 'Activate &amp;#8220;%s&amp;#8221;' ), $title ) ) . '&quot;&gt;' . __( 'Activate' ) . '&lt;/a&gt;';
</span><del>-                        $actions[] = '&lt;a href=&quot;' . $preview_link . '&quot; class=&quot;hide-if-customize&quot; title=&quot;'
-                                . esc_attr( sprintf( __( 'Preview &amp;#8220;%s&amp;#8221;' ), $title ) ) . '&quot;&gt;' . __( 'Preview' ) . '&lt;/a&gt;'
-                                . '&lt;a href=&quot;' . wp_customize_url( $stylesheet ) . '&quot; class=&quot;load-customize hide-if-no-customize&quot;&gt;'
-                                . __( 'Live Preview' ) . '&lt;/a&gt;';
</del><ins>+
+                        $actions['preview'] = '&lt;a href=&quot;' . $preview_link . '&quot; class=&quot;hide-if-customize&quot; title=&quot;'
+                                . esc_attr( sprintf( __( 'Preview &amp;#8220;%s&amp;#8221;' ), $title ) ) . '&quot;&gt;' . __( 'Preview' ) . '&lt;/a&gt;';
+
+                        if ( current_user_can( 'edit_theme_options' ) )
+                                $actions['preview'] .= '&lt;a href=&quot;' . wp_customize_url( $stylesheet ) . '&quot; class=&quot;load-customize hide-if-no-customize&quot;&gt;'
+                                        . __( 'Live Preview' ) . '&lt;/a&gt;';
+
</ins><span class="cx">                         if ( ! is_multisite() &amp;&amp; current_user_can( 'delete_themes' ) )
</span><del>-                                $actions['delete'] = '&lt;a class=&quot;submitdelete deletion&quot; href=&quot;' . wp_nonce_url( &quot;themes.php?action=delete&amp;amp;template=$stylesheet&quot;, 'delete-theme_' . $stylesheet )
</del><ins>+                                $actions['delete'] = '&lt;a class=&quot;submitdelete deletion&quot; href=&quot;' . wp_nonce_url( &quot;themes.php?action=delete&amp;amp;stylesheet=$stylesheet&quot;, 'delete-theme_' . $stylesheet )
</ins><span class="cx">                                         . '&quot; onclick=&quot;' . &quot;return confirm( '&quot; . esc_js( sprintf( __( &quot;You are about to delete this theme '%s'\n  'Cancel' to stop, 'OK' to delete.&quot; ), $title ) )
</span><span class="cx">                                         . &quot;' );&quot; . '&quot;&gt;' . __( 'Delete' ) . '&lt;/a&gt;';
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkwpadminincludesthemephp"></a>
<div class="modfile"><h4>Modified: trunk/wp-admin/includes/theme.php (21009 => 21010)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-admin/includes/theme.php        2012-06-06 16:48:53 UTC (rev 21009)
+++ trunk/wp-admin/includes/theme.php        2012-06-06 20:34:24 UTC (rev 21010)
</span><span class="lines">@@ -11,19 +11,19 @@
</span><span class="cx">  *
</span><span class="cx">  * @since 2.8.0
</span><span class="cx">  *
</span><del>- * @param string $template Template directory of the theme to delete
</del><ins>+ * @param string $stylesheet Stylesheet of the theme to delete
</ins><span class="cx">  * @param string $redirect Redirect to page when complete.
</span><span class="cx">  * @return mixed
</span><span class="cx">  */
</span><del>-function delete_theme($template, $redirect = '') {
</del><ins>+function delete_theme($stylesheet, $redirect = '') {
</ins><span class="cx">         global $wp_filesystem;
</span><span class="cx"> 
</span><del>-        if ( empty($template) )
</del><ins>+        if ( empty($stylesheet) )
</ins><span class="cx">                 return false;
</span><span class="cx"> 
</span><span class="cx">         ob_start();
</span><span class="cx">         if ( empty( $redirect ) )
</span><del>-                $redirect = wp_nonce_url('themes.php?action=delete&amp;template=' . $template, 'delete-theme_' . $template);
</del><ins>+                $redirect = wp_nonce_url('themes.php?action=delete&amp;stylesheet=' . $stylesheet, 'delete-theme_' . $stylesheet);
</ins><span class="cx">         if ( false === ($credentials = request_filesystem_credentials($redirect)) ) {
</span><span class="cx">                 $data = ob_get_contents();
</span><span class="cx">                 ob_end_clean();
</span><span class="lines">@@ -61,11 +61,11 @@
</span><span class="cx">                 return new WP_Error('fs_no_themes_dir', __('Unable to locate WordPress theme directory.'));
</span><span class="cx"> 
</span><span class="cx">         $themes_dir = trailingslashit( $themes_dir );
</span><del>-        $theme_dir = trailingslashit($themes_dir . $template);
</del><ins>+        $theme_dir = trailingslashit($themes_dir . $stylesheet);
</ins><span class="cx">         $deleted = $wp_filesystem-&gt;delete($theme_dir, true);
</span><span class="cx"> 
</span><span class="cx">         if ( ! $deleted )
</span><del>-                return new WP_Error('could_not_remove_theme', sprintf(__('Could not fully remove the theme %s.'), $template) );
</del><ins>+                return new WP_Error('could_not_remove_theme', sprintf(__('Could not fully remove the theme %s.'), $stylesheet) );
</ins><span class="cx"> 
</span><span class="cx">         // Force refresh of theme update information
</span><span class="cx">         delete_site_transient('update_themes');
</span></span></pre></div>
<a id="trunkwpadminthemesphp"></a>
<div class="modfile"><h4>Modified: trunk/wp-admin/themes.php (21009 => 21010)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-admin/themes.php        2012-06-06 16:48:53 UTC (rev 21009)
+++ trunk/wp-admin/themes.php        2012-06-06 20:34:24 UTC (rev 21010)
</span><span class="lines">@@ -16,15 +16,19 @@
</span><span class="cx"> 
</span><span class="cx"> if ( current_user_can( 'switch_themes' ) &amp;&amp; isset($_GET['action'] ) ) {
</span><span class="cx">         if ( 'activate' == $_GET['action'] ) {
</span><del>-                check_admin_referer('switch-theme_' . $_GET['template']);
</del><ins>+                check_admin_referer('switch-theme_' . $_GET['stylesheet']);
+                $theme = wp_get_theme( $_GET['stylesheet'] );
+                if ( ! $theme-&gt;exists() || ! $theme-&gt;is_allowed() )
+                        wp_die( __( 'Cheatin&amp;#8217; uh?' ) );
</ins><span class="cx">                 switch_theme($_GET['template'], $_GET['stylesheet']);
</span><span class="cx">                 wp_redirect( admin_url('themes.php?activated=true') );
</span><span class="cx">                 exit;
</span><span class="cx">         } elseif ( 'delete' == $_GET['action'] ) {
</span><del>-                check_admin_referer('delete-theme_' . $_GET['template']);
-                if ( !current_user_can('delete_themes') )
</del><ins>+                check_admin_referer('delete-theme_' . $_GET['stylesheet']);
+                $theme = wp_get_theme( $_GET['stylesheet'] );
+                if ( !current_user_can('delete_themes') || ! $theme-&gt;exists() )
</ins><span class="cx">                         wp_die( __( 'Cheatin&amp;#8217; uh?' ) );
</span><del>-                delete_theme($_GET['template']);
</del><ins>+                delete_theme($_GET['stylesheet']);
</ins><span class="cx">                 wp_redirect( admin_url('themes.php?deleted=true') );
</span><span class="cx">                 exit;
</span><span class="cx">         }
</span><span class="lines">@@ -60,6 +64,8 @@
</span><span class="cx">         ) );
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+endif; // switch_themes
+
</ins><span class="cx"> if ( current_user_can( 'edit_theme_options' ) ) {
</span><span class="cx">         $help_customize =
</span><span class="cx">                 '&lt;p&gt;' . __('Click on the &quot;Live Preview&quot; link under any theme to preview that theme and change theme options in a separate, full-screen view. Any installed theme can be previewed and customized in this way.') . '&lt;/p&gt;'.
</span><span class="lines">@@ -83,8 +89,6 @@
</span><span class="cx"> wp_enqueue_script( 'theme' );
</span><span class="cx"> wp_enqueue_script( 'customize-loader' );
</span><span class="cx"> 
</span><del>-endif;
-
</del><span class="cx"> require_once('./admin-header.php');
</span><span class="cx"> ?&gt;
</span><span class="cx"> 
</span><span class="lines">@@ -120,9 +124,11 @@
</span><span class="cx"> ?&gt;
</span><span class="cx"> &lt;div id=&quot;current-theme&quot; class=&quot;&lt;?php echo esc_attr( $class ); ?&gt;&quot;&gt;
</span><span class="cx">         &lt;?php if ( $screenshot ) : ?&gt;
</span><ins>+                &lt;?php if ( current_user_can( 'edit_theme_options' ) ) : ?&gt;
</ins><span class="cx">                 &lt;a href=&quot;&lt;?php echo wp_customize_url(); ?&gt;&quot; class=&quot;load-customize hide-if-no-customize&quot; title=&quot;&lt;?php echo esc_attr( $customize_title ); ?&gt;&quot;&gt;
</span><span class="cx">                         &lt;img src=&quot;&lt;?php echo esc_url( $screenshot ); ?&gt;&quot; alt=&quot;&lt;?php esc_attr_e( 'Current theme preview' ); ?&gt;&quot; /&gt;
</span><span class="cx">                 &lt;/a&gt;
</span><ins>+                &lt;?php endif; ?&gt;
</ins><span class="cx">                 &lt;img class=&quot;hide-if-customize&quot; src=&quot;&lt;?php echo esc_url( $screenshot ); ?&gt;&quot; alt=&quot;&lt;?php esc_attr_e( 'Current theme preview' ); ?&gt;&quot; /&gt;
</span><span class="cx">         &lt;?php endif; ?&gt;
</span><span class="cx"> 
</span><span class="lines">@@ -140,9 +146,6 @@
</span><span class="cx">                 &lt;?php theme_update_available( $ct ); ?&gt;
</span><span class="cx">         &lt;/div&gt;
</span><span class="cx"> 
</span><del>-&lt;div class=&quot;theme-options&quot;&gt;
-        &lt;a id=&quot;customize-current-theme-link&quot; href=&quot;&lt;?php echo wp_customize_url(); ?&gt;&quot; class=&quot;load-customize hide-if-no-customize&quot; title=&quot;&lt;?php echo esc_attr( $customize_title ); ?&gt;&quot;&gt;&lt;?php _e( 'Customize' )?&gt;&lt;/a&gt;
-        &lt;span&gt;&lt;?php _e( 'Options:' )?&gt;&lt;/span&gt;
</del><span class="cx">         &lt;?php
</span><span class="cx">         // Pretend you didn't see this.
</span><span class="cx">         $options = array();
</span><span class="lines">@@ -171,13 +174,26 @@
</span><span class="cx">                 }
</span><span class="cx">         }
</span><span class="cx"> 
</span><ins>+        if ( $options || current_user_can( 'edit_theme_options' ) ) :
</ins><span class="cx">         ?&gt;
</span><del>-        &lt;ul&gt;
-                &lt;?php foreach ( $options as $option ) : ?&gt;
-                        &lt;li&gt;&lt;?php echo $option; ?&gt;&lt;/li&gt;
-                &lt;?php endforeach; ?&gt;
-        &lt;/ul&gt;
-&lt;/div&gt;
</del><ins>+        &lt;div class=&quot;theme-options&quot;&gt;
+                &lt;?php if ( current_user_can( 'edit_theme_options' ) ) : ?&gt;
+                &lt;a id=&quot;customize-current-theme-link&quot; href=&quot;&lt;?php echo wp_customize_url(); ?&gt;&quot; class=&quot;load-customize hide-if-no-customize&quot; title=&quot;&lt;?php echo esc_attr( $customize_title ); ?&gt;&quot;&gt;&lt;?php _e( 'Customize' ); ?&gt;&lt;/a&gt;
+                &lt;?php
+                endif; // edit_theme_options
+                if ( $options ) :
+                ?&gt;
+                &lt;span&gt;&lt;?php _e( 'Options:' )?&gt;&lt;/span&gt;
+                &lt;ul&gt;
+                        &lt;?php foreach ( $options as $option ) : ?&gt;
+                                &lt;li&gt;&lt;?php echo $option; ?&gt;&lt;/li&gt;
+                        &lt;?php endforeach; ?&gt;
+                &lt;/ul&gt;
+        &lt;/div&gt;
+        &lt;?php
+                endif; // options
+        endif; // options || edit_theme_options
+        ?&gt;
</ins><span class="cx"> 
</span><span class="cx"> &lt;/div&gt;
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkwpincludesclasswpcustomizemanagerphp"></a>
<div class="modfile"><h4>Modified: trunk/wp-includes/class-wp-customize-manager.php (21009 => 21010)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-includes/class-wp-customize-manager.php        2012-06-06 16:48:53 UTC (rev 21009)
+++ trunk/wp-includes/class-wp-customize-manager.php        2012-06-06 20:34:24 UTC (rev 21010)
</span><span class="lines">@@ -78,11 +78,22 @@
</span><span class="cx">          * @since 3.4.0
</span><span class="cx">          */
</span><span class="cx">         public function setup_theme() {
</span><del>-                if ( ! ( isset( $_REQUEST['customize'] ) &amp;&amp; 'on' == $_REQUEST['customize'] ) &amp;&amp; ! basename( $_SERVER['PHP_SELF'] ) == 'customize.php' )
-                        return;
-
</del><span class="cx">                 send_origin_headers();
</span><span class="cx"> 
</span><ins>+                $this-&gt;original_stylesheet = get_stylesheet();
+
+                $this-&gt;theme = wp_get_theme( isset( $_REQUEST['theme'] ) ? $_REQUEST['theme'] : null );
+
+                // You can't preview a theme if it doesn't exist, or if it is not allowed (unless active).
+                if ( ! $this-&gt;theme-&gt;exists() )
+                        wp_die( __( 'Cheatin&amp;#8217; uh?' ) );
+
+                if ( $this-&gt;theme-&gt;get_stylesheet() != get_stylesheet() &amp;&amp; ( ! $this-&gt;theme()-&gt;is_allowed() || ! current_user_can( 'switch_themes' ) ) )
+                        wp_die( __( 'Cheatin&amp;#8217; uh?' ) );
+
+                if ( ! current_user_can( 'edit_theme_options' ) )
+                        wp_die( __( 'Cheatin&amp;#8217; uh?' ) );
+
</ins><span class="cx">                 $this-&gt;start_previewing_theme();
</span><span class="cx">                 show_admin_bar( false );
</span><span class="cx">         }
</span><span class="lines">@@ -95,20 +106,10 @@
</span><span class="cx">          * @since 3.4.0
</span><span class="cx">          */
</span><span class="cx">         public function start_previewing_theme() {
</span><del>-                if ( $this-&gt;is_preview() || false === $this-&gt;theme || ( $this-&gt;theme &amp;&amp; ! $this-&gt;theme-&gt;exists() ) )
</del><ins>+                // Bail if we're already previewing.
+                if ( $this-&gt;is_preview() )
</ins><span class="cx">                         return;
</span><span class="cx"> 
</span><del>-                // Initialize $theme and $original_stylesheet if they do not yet exist.
-                if ( ! isset( $this-&gt;theme ) ) {
-                        $this-&gt;theme = wp_get_theme( isset( $_REQUEST['theme'] ) ? $_REQUEST['theme'] : null );
-                        if ( ! $this-&gt;theme-&gt;exists() ) {
-                                $this-&gt;theme = false;
-                                return;
-                        }
-                }
-
-                $this-&gt;original_stylesheet = get_stylesheet();
-
</del><span class="cx">                 $this-&gt;previewing = true;
</span><span class="cx"> 
</span><span class="cx">                 add_filter( 'template', array( $this, 'get_template' ) );
</span><span class="lines">@@ -419,13 +420,10 @@
</span><span class="cx">                 if ( ! $this-&gt;is_preview() )
</span><span class="cx">                         die;
</span><span class="cx"> 
</span><del>-                check_ajax_referer( 'customize_controls', 'nonce' );
</del><ins>+                check_ajax_referer( 'customize_controls-' . $this-&gt;get_stylesheet(), 'nonce' );
</ins><span class="cx"> 
</span><span class="cx">                 // Do we have to switch themes?
</span><span class="cx">                 if ( $this-&gt;get_stylesheet() != $this-&gt;original_stylesheet ) {
</span><del>-                        if ( ! current_user_can( 'switch_themes' ) )
-                                die;
-
</del><span class="cx">                         // Temporarily stop previewing the theme to allow switch_themes()
</span><span class="cx">                         // to operate properly.
</span><span class="cx">                         $this-&gt;stop_previewing_theme();
</span></span></pre></div>
<a id="trunkwpincludesjscustomizeloaderdevjs"></a>
<div class="modfile"><h4>Modified: trunk/wp-includes/js/customize-loader.dev.js (21009 => 21010)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-includes/js/customize-loader.dev.js        2012-06-06 16:48:53 UTC (rev 21009)
+++ trunk/wp-includes/js/customize-loader.dev.js        2012-06-06 20:34:24 UTC (rev 21010)
</span><span class="lines">@@ -17,12 +17,9 @@
</span><span class="cx">                         // Ensure the loader is supported.
</span><span class="cx">                         // Check for settings, postMessage support, and whether we require CORS support.
</span><span class="cx">                         if ( ! Loader.settings || ! $.support.postMessage || ( ! $.support.cors &amp;&amp; Loader.settings.isCrossDomain ) ) {
</span><del>-                                this.body.removeClass( 'customize-support' ).addClass( 'no-customize-support' );
</del><span class="cx">                                 return;
</span><span class="cx">                         }
</span><span class="cx"> 
</span><del>-                        this.body.removeClass( 'no-customize-support' ).addClass( 'customize-support' );
-
</del><span class="cx">                         this.window  = $( window );
</span><span class="cx">                         this.element = $( '&lt;div id=&quot;customize-container&quot; /&gt;' ).appendTo( this.body );
</span><span class="cx"> 
</span></span></pre>
</div>
</div>

</body>
</html>