TYPO3 Core

As a quick fix for the developers:

you can reset the request of the controllerContext in the edit action to prevent serialization of the objects

        $this->controllerContext->getRequest()->setArguments(array());

Dimitri Lavrenük wrote:

This issue has been reported in a different context here:
https://forge.typo3.org/issues/57633

we should continue with the discussion there.

After digging a bit i found a huge security issue with this bug. You can get access to all properties of the object and all linked objects.
Typo3 Version: 6.2.3

I agree that this is not nice and should be changed. However this is only a security issue in very specific cases (which are not part of the core), so we can handle that bug in public.

Edit ection -> Save action -> forward to Edit action with the model object as argument

After the save action the form generates a [__referrer][arguments] hidden field with the whole object hashed as base64.

public function editAction (/Dl/Test/Domain/Model/Object $object = null) {
    $this->view->assign('object', $object);
}

public function saveAction (/Dl/Test/Domain/Model/Object $object) {
    $this->forward('edit', null, null, array('object' => $object));
}

Why are you using a forward here anyway? To me it makes more sense to use a redirect for this example.