def publish(request, user_id=None):
    initial = None
    if user_id:  # todo: move to form
        user_to = get_object_or_404(User, pk=user_id)
        initial = {'users': [user_to.st.nickname]}

    user = request.user
    tform = TopicForPrivateForm(
        user=user, data=post_data(request))
    cform = CommentForm(
        user=user, data=post_data(request))
    tpform = TopicPrivateManyForm(
        user=user, data=post_data(request), initial=initial)

    if (is_post(request) and
            all([tform.is_valid(), cform.is_valid(), tpform.is_valid()]) and
            not request.is_limited()):
        if not user.st.update_post_hash(tform.get_topic_hash()):
            return redirect(
                request.POST.get('next', None) or
                tform.category.get_absolute_url())

        # wrap in transaction.atomic?
        topic = tform.save()
        cform.topic = topic
        comment = cform.save()
        comment_posted(comment=comment, mentions=None)
        tpform.topic = topic
        tpform.save_m2m()
        TopicNotification.bulk_create(
            users=tpform.get_users(), comment=comment)
        return redirect(topic.get_absolute_url())

    return render(
        request=request,
        template_name='spirit/topic/private/publish.html',
        context={
            'tform': tform,
            'cform': cform,
            'tpform': tpform})
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.