Allowing theme editing from web can be prone to spam. To disable theme and plugin editor, add the following to wp-config.php
define( 'DISALLOW_FILE_EDIT', true );
In case you want to be even more strict and disable even plugin and theme updates, add the following line to wp-config.php
define( 'DISALLOW_FILE_MODS', true );
