Steps to reproduce
- Make sure the anonymous has no permission to read form submissions
- Create a form with an upload widget
- Log out from the backend
- Submit the form with a file attached
- See a blank page
- See the attachment created in the backend
I tracked down the cause to the event handler, that invokes the PublishContent Event which is handled by the `StartWorkflowSubscriber`. There it tries to read the content, but does not have permission to (which is wanted).
a) Use sudo in the EventListener to always be able to read the content
b) try-catch failed events, log them and continue.