def vote(request, pk):
    # TODO: check if user has access to this topic/poll
    poll = get_object_or_404(
        CommentPoll.objects.unremoved(),
        pk=pk
    )

    if not request.user.is_authenticated:
        return redirect_to_login(next=poll.get_absolute_url())

    form = PollVoteManyForm(user=request.user, poll=poll, data=request.POST)

    if form.is_valid():
        CommentPollChoice.decrease_vote_count(poll=poll, voter=request.user)
        form.save_m2m()
        CommentPollChoice.increase_vote_count(poll=poll, voter=request.user)
        return redirect(request.POST.get('next', poll.get_absolute_url()))

    messages.error(request, utils.render_form_errors(form))
    return redirect(request.POST.get('next', poll.get_absolute_url()))
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.