Description

In Add Theme Previews for block themes
a special GET parameter makes it possible to preview block themes in the site editor.

Because to make this work the PR filtered stylesheet and template options, this special parameter is also taking effect on the front end effectively allowing one to switch the current theme to whatever is installed.

This is problematic security wise because:

• it exposes what themes the user has installed via trial and error
• it exposes potentially in progress work
• it allows for sharing of links with the preview on

The theme_preview GET param should only work if the user is logged in and has the correct permissions for editing themes.

Step-by-step reproduction instructions

0. Using Gutenberg trunk and the theme preview experiment active
1. On the front end
2. Append ?theme_preview=[path to theme]
3. You'll see the website with the specified theme

Screenshots, screen recording, code snippet

N/A

Environment info

No response

Please confirm that you have searched existing issues in the repo.

Yes

Please confirm that you have tested with all plugins deactivated except Gutenberg.

Yes