Live Theme Preview

Browse any installed theme, in the real site context, without activating it or touching config.json. Works entirely through a signed token in the URL.

How it works

1. Admin clicks Live Preview in the theme manager.
2. admin/theme-preview.php (GET ?theme=themename): verifies the theme exists, builds a signed token — base64url(themeName|unixTimestamp|HMAC-SHA256) — using a dedicated per-install secret at private/theme_preview.secret, and redirects to the site root with ?_tp=TOKEN.
3. index.php → loadConfig(): if ?_tp is present and $_SESSION['admin'] === true, the token is decoded and verified (HMAC + 2-hour TTL). If valid, active_theme is overridden for this request only — config.json is never written.
4. All internal href links are rewritten client-side to append ?_tp=TOKEN, with a MutationObserver watching for dynamically added links.
5. Closing the preview tab simply drops the token — nothing to clean up server-side.

Security

• HMAC-SHA256, 2-hour TTL, secret is a dedicated private/ file — not derived from any account's password, so it keeps working the same way regardless of which admin account previews or how many accounts exist.
• Only honored when $_SESSION['admin'] === true.
• basename() applied to the theme name (path traversal prevention).

Files involved