Warning: Shared videos can be deleted by share recipients

[perolavb]

Hi.

We have encountered an issue regarding sharing of videos in Canvas Studio. We feel we should warn the community about this.

If you (user A) share a video with someone and choose "Can edit" permission, the recipient (user B) can delete your video. There is a warning in place that this is a possibility, so in that regards it's OK. Though in my opinion "Edit" does not encompass the functionality of deleting, but that is another discussion.

BUT and here is the warning:

If a user(user A) share a video with "Can view" permission with another user (user B). User B can then re-share the video with another user (user C) with "Can edit" permission. If user C then delete the video it get deleted from all users in the share chain including user A. How in the world is it possible for a video to be re-shared with higher permissions (Can edit) than the initial permission setting (Can view)?

As a side note; we are getting quite fed up by being treated as beta tester by Instructure. They rely on us paying customers to find these "bugs" and report them. This is such a massive bug and should not have ended up in production code. 

[Tami_B]

Hi @perolavb, thank you for letting us know about this issue. Our product team has been informed and they are looking into it. Please let us know if you have any further questions!

Thanks,
Tami

[Jeff_F]

I'd like to see three levels of permissions.  Something along the lines of:

1. View
2. Edit (Title, Description, tags, captions, download original file, share)
3. Full/ owner (Includes above Edit permissions along with revoke share and delete)

[bogardde]

Hi, I just now found this thread and am wondering if there has been a resolution to this problem. If not, I need to warn our staff about this. Thanks much!

[AkosFarago]

Hi @Jeff_F, @perolavb, @bogardde,

Seems like we had fixed this issue around last fall, users with can view access can only share the content with can view access, so there will be no option to delete that.

Best,

Akos