Updated Rich Content Editor breaks LTI links

[RanjeetSingh]

Today we started getting support tickets that items containing Kaltura LTI embeds break if you go to edit mode for the item. It's happening to other LTIs that use iframe embeds, too, Kaltura was just the first one that somebody noticed.  Going to edit mode seems to be stripping portions of the html.  An error message "Couldn't find valid settings for this link" will briefly appear, and then if you save the resulting HTML will be invalid. 

Have any of you LTI developers out there using iframe run into this issue?  My only guess so far is that it's caused by the Rich Content Editor Supports Pasting and the Drag and Drop of Content update described in https://community.canvaslms.com/t5/Canvas-Releases/Canvas-Deploy-Notes-2023-02-15/ta-p/553929. 

[chriscas]

Hi @RanjeetSingh,

I just tested this in our environment (Instructure hosted Canvas with vanity domain, LTI 1.3 Kaltura KAF with vanity domain) and did not run into any errors.  Can you tell us more about the environment you're running?

-Chris

[RanjeetSingh]

Thanks for the quick response, @chriscas !  We are also on Instructure hosted Canvas.  Unfortunately I can't see which version of Kaltura KAF LTI we're on, but I know from some Teams chats that we have not yet upgraded to 1.3. 

A better description of the problem is that the Canvas Rich Content Editor strips out the parameters when we hit the Edit button.  For example, a Page with a Kaltura embed has an iframe with src="/courses/7452/external_tools/retrieve?display=borderless&amp;url=https%3A%2F%2Fkaf.<our subdomain>.edu%2Fbrowseandembed%2Findex%2Fmedia%2Fentryid%2F...  When we hit the Edit button, the "Couldn't find valid settings for this link" error pops up and the iframe now has src="/courses/7452/external_tools/retrieve". 

[matthew_buckett]

In your example the Kaltura LTI is embedded and the URL of /courses/7452/external_tools/retrieve?display=borderless&amp;url=https://...  is failing, this URL is attempting to lookup the Kaltura LTI by the launch URL in the tool configuration. In our instance we use Panopto, but it embeds in a very similar way and these embeds are continuing to work through an edit/save cycle on both a LTI 1.1 and LTI 1.3 tool.

I'm assuming this the error you are seeing:

What's strange is that if I purposely insert an invalid url that doesn't match a tool in Canvas it doesn't strip it for me, so if I have an tag of:

<iframe
  class="lti-embed"
  style="width: 720px; height: 405px;"
  title="Broken"
  src="https://instance.instructure.com/courses/1234/external_tools/retrieve?display=borderless&amp;url=https%3A%2F%2Funknown"
  width="720"
  height="405"
  allowfullscreen="allowfullscreen"
  webkitallowfullscreen="webkitallowfullscreen"
  mozallowfullscreen="mozallowfullscreen"
  allow="geolocation *; microphone *; camera *; midi *; encrypted-media *; autoplay *; clipboard-write *; display-capture *"
></iframe>

in the RCE, save it and then go back to edit it again, it still remains as I left it. This is despite the fact that we don't have any tool with a launch URL of https://unknown 

This is on an Instructure hosted Canvas instance. 

[matthew_buckett · Accepted solution]

I think Instructure have reverted this change:

https://github.com/instructure/canvas-lms/commit/f7d97c3c5b036c090bf8439463a4524b00ce8bea

which was causing the problems. Here's the revert that has just recently been done:

https://github.com/instructure/canvas-lms/commit/7d1e0399efb52744aab8b3bfbb20d0255e655c82

So either the instance I was testing on didn't have the original fix or the revert has already been applied.

[RanjeetSingh]

Thank you @matthew_buckett !  Embedded iframes from Kaltura and other LTIs are working again today after the RCE change was reverted. 

[matthew_buckett]

@RanjeetSingh glad it's working for you again, however I just got a notification on the known issues page and that this issue isn't closed:

https://community.canvaslms.com/t5/Known-Issues/OPEN-LTI-embeds-in-rce-content-lose-all-their-url-pa...

Maybe Instructure are leaving it open as they haven't updated all their instances, I'm not sure.