Language: Python
Label: vulnerable
CWE: CWE-601 \u2014 URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

Code:
def loginForm(request, next=''):
    # if this is a POST request we need to process the form data
    if request.method == 'POST':
        # create a form instance and populate it with data from the request:
        form = Login_Form(request.POST)
        # check whether it's valid:
        if form.is_valid():
            username = request.POST.get('username')
            password = request.POST.get('password')
            user = user = authenticate(username=username, password=password)
            if user and user.is_active:
                login(request, user)
                next_url = request.POST.get('next', '')
                if next_url and next_url.startswith('/'):
                    return HttpResponseRedirect(next_url)
                else:
                    return HttpResponseRedirect(reverse('CalendarinhoApp:Dashboard'))
            else:
                messages.error(request, "Invalid login details given")
                form = Login_Form()
                return render(request, 'CalendarinhoApp/login.html', {'form': form})

    # if a GET (or any other method) we'll create a blank form
    else:
        form = Login_Form()
        return render(request, 'CalendarinhoApp/login.html', {'form': form})