def delete(request, pk, remove=True):
    comment = get_object_or_404(Comment, pk=pk)
    if is_post(request):
        (Comment.objects
         .filter(pk=pk)
         .update(is_removed=remove))
        return redirect(request.GET.get('next', comment.get_absolute_url()))
    return render(
        request=request,
        template_name='spirit/comment/moderate.html',
        context={'comment': comment})
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.