[OSSA-2020-008] horizon: Open redirect in workflow forms