from zenaida.contrib.hints.models import Dismissed
from zenaida.contrib.hints.forms import DismissHintForm

from django.http import (HttpResponse, HttpResponseNotAllowed,
                        HttpResponseBadRequest, HttpResponseRedirect)

def dismiss(request):
    if not request.POST:
        return HttpResponseNotAllowed(['POST'])
    else:
        form = DismissHintForm(request.POST)
        dismissed = form.save(commit=False)
        dismissed.user = request.user
        dismissed.save()
        if 'next' in request.GET:
            next_url = request.GET['next']
        else:
            next_url = request.META['HTTP_REFERER']
        return HttpResponseRedirect(next_url)

from zenaida.contrib.hints.models import Dismissed
from zenaida.contrib.hints.forms import DismissHintForm

from django.core.exceptions import SuspiciousOperation
from django.http import (HttpResponse, HttpResponseNotAllowed,
                        HttpResponseBadRequest, HttpResponseRedirect)
from django.utils.http import is_safe_url


def dismiss(request):
    if not request.POST:
        return HttpResponseNotAllowed(['POST'])
    else:
        form = DismissHintForm(request.POST)
        dismissed = form.save(commit=False)
        dismissed.user = request.user
        dismissed.save()
        if 'next' in request.GET:
            next_url = request.GET['next']
        else:
            next_url = request.META['HTTP_REFERER']

        if not is_safe_url(next_url, host=request.get_host()):
            raise SuspiciousOperation("Url {} is not safe to redirect to.".format(next_url))

        return HttpResponseRedirect(next_url)

Check url safety before redirecting. Safety first!
[hints] Check url safety before redirecting. Safety first!

  from zenaida.contrib.hints.models import Dismissed
  from zenaida.contrib.hints.forms import DismissHintForm
  
+ from django.core.exceptions import SuspiciousOperation
  from django.http import (HttpResponse, HttpResponseNotAllowed,
                          HttpResponseBadRequest, HttpResponseRedirect)
+ from django.utils.http import is_safe_url
+ 
  
  def dismiss(request):
      if not request.POST:
          return HttpResponseNotAllowed(['POST'])
      else:
          form = DismissHintForm(request.POST)
          dismissed = form.save(commit=False)
          dismissed.user = request.user
          dismissed.save()
          if 'next' in request.GET:
              next_url = request.GET['next']
          else:
              next_url = request.META['HTTP_REFERER']
+ 
+         if not is_safe_url(next_url, host=request.get_host()):
+             raise SuspiciousOperation("Url {} is not safe to redirect to.".format(next_url))
+ 
          return HttpResponseRedirect(next_url)
  
Check url safety before redirecting. Safety first!
## Code Before:
from zenaida.contrib.hints.models import Dismissed
from zenaida.contrib.hints.forms import DismissHintForm

from django.http import (HttpResponse, HttpResponseNotAllowed,
                        HttpResponseBadRequest, HttpResponseRedirect)

def dismiss(request):
    if not request.POST:
        return HttpResponseNotAllowed(['POST'])
    else:
        form = DismissHintForm(request.POST)
        dismissed = form.save(commit=False)
        dismissed.user = request.user
        dismissed.save()
        if 'next' in request.GET:
            next_url = request.GET['next']
        else:
            next_url = request.META['HTTP_REFERER']
        return HttpResponseRedirect(next_url)

## Instruction:
Check url safety before redirecting. Safety first!
## Code After:
from zenaida.contrib.hints.models import Dismissed
from zenaida.contrib.hints.forms import DismissHintForm

from django.core.exceptions import SuspiciousOperation
from django.http import (HttpResponse, HttpResponseNotAllowed,
                        HttpResponseBadRequest, HttpResponseRedirect)
from django.utils.http import is_safe_url


def dismiss(request):
    if not request.POST:
        return HttpResponseNotAllowed(['POST'])
    else:
        form = DismissHintForm(request.POST)
        dismissed = form.save(commit=False)
        dismissed.user = request.user
        dismissed.save()
        if 'next' in request.GET:
            next_url = request.GET['next']
        else:
            next_url = request.META['HTTP_REFERER']

        if not is_safe_url(next_url, host=request.get_host()):
            raise SuspiciousOperation("Url {} is not safe to redirect to.".format(next_url))

        return HttpResponseRedirect(next_url)
