We have a community which has a lightning:fileUpload component for guests to upload anonymous file attachments to their created records. The guest user creates a new record via a global action which then takes them to a modified record detail page containing the file upload component. We accomplish this by enabling the guest user file upload checkbox and providing the record id to the file upload component.
As of this morning, Salesforce have rolled out the 'Assign Records Created by Guest Users to a Default Owner' security update, which, when enabled, blocks guest users from uploading files, even if they have the modify all permission on the custom object.
Is this a Salesforce bug which needs a case raising or intended functionality of this update as there is no mention on the update documentation (https://releasenotes.docs.salesforce.com/en-us/winter20/release-notes/rn_networks_guest_user.htm) and the enable guest file uploads still remains visible and checked. If the update is disabled, the file upload component immediately works again.
Thanks
Best Answer
Partner support have replied to me and provided a working solution!
Follow this tutorial https://developer.salesforce.com/blogs/developer-relations/2017/05/build-lightning-file-uploader-component.html but change the file upload apex class to 'without sharing'. Then embed the component within a flow following from the record creation passing through the new record id into the recordId attribute (I did it through a design attribute).
For now this will upload to notes & attachments rather than files but I assume a process builder or other solution could move it over if required.
Partner support does note that: ">>If you want to try this, another thing to keep in mind is the entry point of the Apex without sharing logic should be protected by some secure access code, for ex. an encrypted record id. "