def resend_activation_email(request):
    if request.user.is_authenticated:
        return redirect(request.GET.get('next', reverse('spirit:user:update')))

    form = ResendActivationForm(data=post_data(request))
    if is_post(request):
        if not request.is_limited() and form.is_valid():
            user = form.get_user()
            send_activation_email(request, user)

        # TODO: show if is_valid only
        messages.info(
            request, _(
                "If you don't receive an email, please make sure you've entered "
                "the address you registered with, and check your spam folder."))
        return redirect(reverse(settings.LOGIN_URL))
    return render(
        request=request,
        template_name='spirit/user/auth/activation_resend.html',
        context={'form': form})
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.