Encoding themeHandle variables in order to prevent XSS vulnerability.

I found that themeHandle variables used without input validation/encoding so it cause to Cross-Site Scripting Vulnerability.

PoC:

http://localhost/concrete5/index.php/tools/required/themes/preview?previewCID=1&ctID=&themeHandle=1337"></iframe><script>alert(1)</script><!--

You will get pop-up message.