		wp_send_json_error( $status );
	}

	if ( current_user_can( 'switch_themes' ) ) {
		if ( is_multisite() ) {
			$status['activateUrl'] = add_query_arg( array(
				'action'   => 'enable',
				'_wpnonce' => wp_create_nonce( 'enable-theme_' . $slug ),
				'theme'    => $slug,
			), network_admin_url( 'themes.php' ) );
		} else {
			$status['activateUrl'] = add_query_arg( array(
				'action'     => 'activate',
				'_wpnonce'   => wp_create_nonce( 'switch-theme_' . $slug ),
				'stylesheet' => $slug,
			), admin_url( 'themes.php' ) );
		}
	}

	if ( ! is_multisite() && current_user_can( 'edit_theme_options' ) && current_user_can( 'customize' ) ) {
		$status['customizeUrl'] = add_query_arg( array(
			'return' => urlencode( network_admin_url( 'theme-install.php', 'relative' ) ),
		), wp_customize_url( $slug ) );
	}

	/*
	 * See WP_Theme_Install_List_Table::_get_theme_status() if we wanted to check
	 * on post-install status.
	 */
	wp_send_json_success( $status );
}
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.