| @@ -385,9 +385,13 @@ | ||
| 385 | 385 | if ( ! current_user_can( 'switch_themes' ) ) { |
| 386 | 386 | return $this->get_permission_error_response(); |
| 387 | 387 | } |
| 388 | 388 | |
| 389 | - $theme_slug = 'hello-elementor'; | |
| 389 | + $theme_slug = Utils::get_super_global_value( $_POST, 'theme_slug' ) ?? 'hello-biz'; // phpcs:ignore WordPress.Security.NonceVerification.Missing | |
| 390 | + $allowed_themes = [ 'hello-elementor', 'hello-biz' ]; | |
| 391 | + if ( ! in_array( $theme_slug, $allowed_themes, true ) ) { | |
| 392 | + $theme_slug = 'hello-biz'; | |
| 393 | + } | |
| 390 | 394 | |
| 391 | 395 | switch_theme( $theme_slug ); |
| 392 | 396 | |
| 393 | 397 | return [ |
