def join_in(request, topic_id):
    # todo: replace by create_access()?
    # This is for topic creators who left their own topics and want to join again
    topic = get_object_or_404(
        Topic,
        pk=topic_id,
        user=request.user,
        category_id=settings.ST_TOPIC_PRIVATE_CATEGORY_PK)
    form = TopicPrivateJoinForm(
        topic=topic,
        user=request.user,
        data=post_data(request))
    if is_post(request) and form.is_valid():
        topic_private = form.save()
        notify_access(user=form.get_user(), topic_private=topic_private)
        return redirect(request.POST.get('next', topic.get_absolute_url()))
    return render(
        request=request,
        template_name='spirit/topic/private/join.html',
        context={
            'topic': topic,
            'form': form})
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.