diff --git a/combo/public/views.py b/combo/public/views.py
index 44243cdb..f5eec4a3 100644
--- a/combo/public/views.py
+++ b/combo/public/views.py
@@ -120,6 +120,8 @@ def skeleton(request):
     #     {% block content %}
     #     {% endblock %}
     #   {% endblock %}
+    if 'source' not in request.GET:
+        raise PermissionDenied()
     source = request.GET['source']
     selected_page = None