If forgery protection is disabled that a guest user can post and create any objects on your Hobo site. I had to disable forgery protection on a site to provide an XML API to my Hobo site easily and quicly.
Here is my workaround and experience: http://conceptspace.wikidot.com/blog:hobo-security-hole -- You received this message because you are subscribed to the Google Groups "Hobo Users" group. To post to this group, send email to [email protected]. To unsubscribe from this group, send email to [email protected]. For more options, visit this group at http://groups.google.com/group/hobousers?hl=en.
