A form without "save answers" still saves the file uploads

[SG-fabian]

Bug description

Even with "save answers" unchecked the file uploads remain inside the selected folder.

We have a form on our website where the user can upload sensitive content - including up to three images. We don't want that on the server and only send it by mail.

How to reproduce

Create a form with file upload, uncheck "save answers", select a mail address instead.

Logs

No response

Environment

Environment
Application Name:
Laravel Version: 9.52.4
PHP Version: 8.2.2
Composer Version: 2.5.1
Environment: local
Debug Mode: ENABLED
URL:
Maintenance Mode: OFF

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: CACHED

Drivers
Broadcasting: log
Cache: statamic
Database: mysql
Logs: stack / single
Mail: smtp
Queue: sync
Session: file

Statamic
Addons: 3
Antlers: runtime
Stache Watcher: Enabled
Static Caching: Disabled
Version: 3.4.5 PRO

Statamic Addons
jonassiewertsen/statamic-livewire: 2.11.0
statamic/seo-pro: 4.0.1

Installation

Starter Kit using via CLI

Antlers Parser

runtime (new)

Additional details

No response

[SG-fabian]

We've added a listener for now that wipes all files but the latest. The newly uploaded files are needed to generate the email (they have be somewhere) but we could not find a suitable "after email sent" hook to wipe them afterwards. This solution is okay in our case but not ideal.

    public function handle(AssetSaved $event)
    {
        $files = Storage::disk('form_uploads')->allFiles('');

        foreach ($files as $file) {
            $time = Storage::disk('form_uploads')->lastModified($file);
            $filetime = Carbon::parse($time);

            if (Carbon::now()->gt($filetime->addMinutes(1))) {
                Storage::disk('form_uploads')->delete($file);
            }
        }

        return true;
    }

We've tried to wipe the complete folder using the FormSubmitted handle but that does not work since the new files are already uploaded.

[duncanmcclean]

This will be addressed in Statamic v5. You'll be able to use the "Files" fieldtype for file uploads which shouldn't be stored on the server.

[ewhicher]

@duncanmcclean Does this mean there is still no way to address this in v4?

[duncanmcclean]

Yes, that's correct. It'll only be possible in Statamic 5 which is coming in the next few weeks.