-$icon_theme = getPref($data_dir, $username, 'icon_theme', 'images/themes/xp/' );
+$icon_theme = getPref($data_dir, $username, 'icon_theme');
+$default_icon_theme = $icon_themes[$icon_theme_def]['PATH'];
+$found_theme = false;
+
+// Make sure the chosen icon theme is a legitimate one.
+// need to adjust $icon_theme path with SM_PATH
+$icon_theme = preg_replace("/(\.\.\/){1,}/", SM_PATH, $icon_theme);
+$k = 0;
+while (!$found_theme && $k < count($icon_themes)) {
+ if ($icon_themes[$k]['PATH'] == $icon_theme)
+ $found_theme = true;
+ $k++;
+}
+if (!$found_theme) {
+ $icon_theme = $default_icon_theme;
+}