Fix security issue in index.php theme selector