def mark_all_as_read(request):
    (TopicNotification.objects
        .for_access(request.user)
        .filter(is_read=False)
        .update(is_read=True))
    return redirect(request.POST.get(
        'next', reverse('spirit:topic:notification:index')))
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.