Engineers are currently investigating the issue.
Description
When a user has an observer enrollment in a course they are able to view unpublished assignments for the course on the calendar.
-
If the observer clicks the link to go the the assignment they are met with an access denied message, but they can get the full assignment details via the calendar_events API.
-
The observer enrollment can be in any state, including deleted, and the user can have enrollments with other roles in the course and they are still able to view the unpublished assignments on the calendar.
Expected Behavior
Instead unpublished assignments should not display on the calendar for observers (unless the permissions for the role have been edited to allow for this)
Workaround
No workaround exists at this time.
Steps to Reproduce
Prerequisites: A published course with an unpublished assignment, and an observer and student enrolled.
-
Act as the student and view the calendar. Note that the unpublished assignment does not display.
-
Link the observer to the student.
-
Act as the observer and view the calendar. Note that the unpublished assignment displays.
-
Follow the link to the assignment details page and note that an Access Denied message is dispalyed.
Additional Info
VICE-4991
Known issues indicate notable behaviors that have been escalated to the Canvas engineering team. Known issues are not a guarantee for an immediate resolution. This document is for informational purposes only and does not replace the Support process. If you are encountering the behavior outlined in this document, please ensure you have submitted a Support case (per your institution's escalation process) so Canvas Support can adequately gauge the overall customer impact and prioritize appropriately.
