Ticket #20852: 20852.diff

wp-admin/customize.php

@@ -18 +18 @@
 if ( ! $theme )
         $theme = get_stylesheet();
 
+// Make sure theme exists first, and is allowed (multisite only).
+$theme = wp_get_theme( $theme );
+if ( ! $theme->exists() || ! $theme->is_allowed() )
+        wp_die( __( 'Cheatin’ uh?' ) );
+
 $registered = $wp_scripts->registered;
 $wp_scripts = new WP_Scripts;
 $wp_scripts->registered = $registered;