The problem: If you create formfields, extbase don't know, if they are allowed or not. It's up to you to define this information for each property on your own.
The solution: Fluids FormViewHelpers knows all formfields (created with f:form.*) you have implemented. With help of renderTrustedPropertiesField() it renders a hidden textfield with all allowed formfields allowed for next request in serialized format.
The ActionController has a method called initializePropertyMappingConfigurationFromRequest() where we have a foreach over all trustedProperties. If one of the properties are also required by your ActionMethod this property and/or DomainModel-properties will all get a standardized PropertyMapperConfiguration, where we save the information that this property is allowed for current request.
If you add a formfield without f:form.* it will not be inserted in trustedProperties, will not get a PropertyMapperConfiguration and extbase will fail with an Exception: Property is not allowed.
No problem with fixed relations:
You have a form where you build up a 1:N relation like person:email. Each person can only have a maximum of 5 emails. You build these 5 emailfields with f:form.*. Fluid will render the correct trustedProperties for person.email.[0-4].mailAddress. There is no need to explicit allow the subproperties.
A little problem with variable relations:
You have a form where you build up a 1:N relation like person:email. It's up to the person to define how many email addresses he will declaire. You build ONE emailfields with f:form.* and if the visitor clicks on a JavaScript-Button you copy the rendered emailform and change the name attribute. Fluid will render trustedProperties ONLY for first emailfield, because it was builded by f:form.*. All dynamically created fields (the copy) are unknown to fluid and you have to modify PropertyMappingConfiguration on your own with: $propertyMappingConfiguration->forProperty('email.*')->allowProperties('mailAddress');
What happens in extbase?
The first email is allowed, because there is the PropertyMappingConfiguration coming from trustedProperties: person.email.0.emailAddress. For sure there is also our PropertyMappingConfiguration for person.email.*.emailAddress, but Configurations with a matching key (in our case 0) have priority. For further emails there is no matching key and * comes into process.
Good to know:
With each call to forProperty() you automatically create a new PropertyMappingConfiguration for all properties in your path
The problem with typeConverters:
You have a form where you build up a 1:N relation like company:employees. It's up to the employer to add one or more employees to his company. So we have same like above. We build a basic employee form with f:form.* and create a JavaScript Button to create a copy of this form and increase the name-attribute on each copy. Fluid adds the formfields of our FIRST employee to trustedProperties. Further copied employees are unknown. It's up to you to allow further Employees in initializeCreateAction() with forProperty('company.employees.*')->allowProperties('firstName', 'lastName', 'dateOfBirth', ...). An employee has a birthday. So you add following to your Configuration:
setTypeConverterOption(
'TYPO3\\CMS\\Extbase\\Property\\TypeConverter\\DateTimeConverter',
\TYPO3\CMS\Extbase\Property\TypeConverter\DateTimeConverter::CONFIGURATION_DATE_FORMAT,
'd.m.Y'
);
OK, what will happen in Extbase?
The PropertyMapper will get the first employee (index key is 0). He will find the automatically created PropertyMappingConfiguration of Fluid, which was created with help of the trustedProperties. This is because it has a higher index than our Configuration with *. So PropertyMapper will NOT find our configuration how to convert a string to DateTime and extbase will fail with an Exception.
So, what can you do?
As long as you don't need TypeConvertes you're happy with methods like forProperty() and allowProperties(). If you need TypeConverter for properties in a 1:N relation you have to build your form fields on your own. Without f:form.*! All sub-properties are now unknown. So no standardized PropertyMappingConfiguration can be builded by extbase. Now you can create your own * Configuration which no has priority and your form works again.