Honour visibility settings in Files notifications

[dsweeney2]

This idea has been developed and deployed to Canvas

Some instructors require the Files area to be visible in their course. If a file is uploaded to the Files area a notification is sent to students who have chosen this setting. Even if the file is set to 'only available to students with a link' a notification with a link is sent.This notification constitutes a 'link' and the file is then visible to the student even if no content in the course links to the file.

This is a problem for us where a term paper is uploaded for an assignment, but there are students with different starting times created through assignment overrides. Even if we schedule the release of the file, students with a later start time (and therefore no link in the course) can get access to the file.

It would be preferable if new file notifications that have access restrictions are only sent when the student has access to the file.

(this is a follow up to case 05901225)

[RebeccaMoulder]

I can't fathom any possible use case in which an instructor would want to restrict access to a file in the Files area, but still have the link be accessible to students who happen to have file notifications enabled. Faculty at Wharton rely heavily on the ability to link to exam and other protected files within Canvas, and since this change was made (possibly as a consequence of the course-level notifications feature release on June 20th) we have already had an incident in which the security of a high-stakes exam was breached. 

 @dsweeney2 , your scenario of an exam with multiple availability windows is a perfect example of why scheduled file availability isn't an acceptable workaround. This is clearly a bug and needs to be fixed so that students do not receive notifications for restricted files.

[jeremy_stevens]

I'd like to second Rebecca's comments above. We hide the 'Files' area in the navigation by default at our institution, but sometimes academics will enable it on a course-by-course basis. We had a similar instance where the contents of a final exam were visible to (but thankfully, not accessed by) students. It seems crucial that where the Files area is visible to students, the access settings for those files are respected by Canvas notifications.

[gemma_sinclair]

We had to amend our processes for exam alternatives using Canvas due to this issue. We did not expect notifications to go out that included link to content to students when content was set to limited visibility. Our workaround was to ensure multiple files were imported as part of assessment so that a generic notification would be generated ("2 files have been uploaded"). 

[erinhmcmillan]

Comments from Instructure

For more information, please read through the Canvas Deploy Notes (2020-09-09)