[CRITICAL] C8: PublicShareController::uploadDocument is a stub — citizen uploads silently discarded (BABS evidence lost)

[rubenvdlinde]

Severity: CRITICAL

Location: lib/Controller/PublicShareController.php:264-301, lib/Service/CaseSharingService.php:501-520

Description:
PublicShareController::uploadDocument returns {success: true, ...metadata} to the citizen's browser, but CaseSharingService::storeExternalDocument is a stub: it only logs the incoming metadata and returns the constructed metadata array. The PHP temporary file ($_FILES['file']['tmp_name']) is destroyed when the request ends. No data is written to Nextcloud Files, nor is any file attachment created in OpenRegister.

For BABS (Burgemeester en Aldershandschriften) and general case-evidence submissions this is a legally-relevant data-loss bug: citizens receive confirmation that their document was received, but the document is never accessible to medewerkers.

This is distinct from a latent feature — the endpoint is exposed in the UI as a working upload mechanism and the response explicitly claims success.

Scenario:

1. Citizen receives a public share link for their case and uploads a document (e.g., a bezwaarschrift attachment).
2. UI shows "Document succesvol geüpload".
3. Medewerker opens the case — the document is not there.
4. Deadline for processing the document passes; legal consequences for the municipality.

Suggested fix:
Until proper persistence is implemented, return HTTP 501 Not Implemented so the UI can show an accurate error message.

For proper implementation:

• Move the uploaded file to a Nextcloud Files location (e.g., userFolder/Cases/{caseId}/external-uploads/).
• Create an OR file-attachment record linking the file to the case object.
• Only then return {success: true}.

Source: deep team-reviewer pass 2026-05-27

[rubenvdlinde]

Fixed in PR #661 (merged to development). PublicShareController.uploadDocument() now returns 501 Not Implemented instead of false-success {success:true}.