Only set the URI of the citizenspace site if it validates
Escape url before packing into admin form
Also escape the URL on the shortlink builder. As this checks the URL is a valid CS url, it was probably never vulnerable, but better safe than sorry.
Add CSRF authenticator to change URL field
Add CSRF protection to the shortcode generator
Update changelog