[ARCHIVED] TAs can now edit course settings?

[cms_hickss]

Thanks to  @millerjm ​ we just noticed that our TAs have gained access to items that they did not have before and that Teachers still do not have access to.

We have the following setting turned off for TAs:

• Change course state

On the Course Settings Page our TAs can now change:

• Name
• Course Code
• File Storage size
• Department
• Start Date
• End Date
• License
• Visibility
• Format

On the Course Settings Page our Teachers cannot change:

• Name
• Course Code
• File Storage size
• Department

Has anyone else noticed this change?

[millerjm]

Hey Susan, thanks for posting this.  I opened up a ticket yesterday about it and did some more testing today.  Our TA role has these rights: 

• Create and edit assessing rubrics
• Edit grades
• Manage wiki (add / edit / delete pages)
• Post to discussions
• See the list of users
• Send messages to individual course members
• Send messages to the entire class
• View all grades
• View all students' submissions and make comments on them
• View discussions
• View the group pages of all student groups
• View usage reports for the course

We have the following settings turned OFF for TAs:

• Change course state
• Manage all other course content

We are not noticing this behavior that TA can change these items.  We have the ability for teachers to change these items turned off as well.  I'm not sure what we have set up differently at Seminole than what UCF has. 

• Name
• Course Code
• File Storage size
• Department

Anyone else notice this?

[millerjm]

A few more things. 

Looks like the TA role can also edit these things in course settings:

• Navigation
• Apps
• Feature Options

And, if anyone wants to put some feedback on this feature idea...here is today's photo of pulling up the permissions page.  You can vote for improvements here.  It's in the Gathering Info stage.

[cms_hickss]

 @millerjm ​ have you received a response from your support ticket yet?

I received this: "The permissions should be inherent with the role they are put in, not necessarily a permission setting when it comes to the course settings. If the TAs have more access than the teachers, this would lead me to believe it could be a JS/CSS problem."

[millerjm]

cms_hickss​

No, I haven't had any response.  We have hardly anything in our JS/CSS right now.  I'm literally working right now on the code to use JS to lock down everything for TA specifically, though! 

Our TA's do not have more access than instructors like you have noticed, though. 

Joni

[kona]

I just did some testing and I've got a TA role that ONLY has permission to edit grades and view grades. That's it. Two permissions, everything else is turned completely off. With these permissions the person can still:

• Start/end dates & times
• License
• Visibility
• Format
• Description
• And all the extra options at the bottom of the Course Settings page
• Navigation tab (can change everything)
• Apps (can add apps)
• Feature Options (can turn on and off feature options)

This definitely not the way we would want things set-up, but I don't see any way of blocking this and still allow TA's to grade.

[ejackson]

Oh no.

We locked these settings down for a good reason. After a huge mess last semester when we had an entire course worth of content deleted, we made a point to lock things down so that people with that TA role could do just grading and viewing in their section's grades. And nothing else.

The last thing we need is for someone to get curious and start nosing around and change settings and turn feature options on/off. No. Just NO. Not acceptable.

Canvas, you need to fix this please?

[millerjm]

I've been trying to figure out a temporary fix for this using the js file but I'm running into problems and it looks like the TA role is incorrectly using the role of teacher.

when I login on our test instance as a TA user that I created and enrolled in a course.  I'm in no way an expert at these js files

I used chrome console to see what is going on when I'm in a course, it's showing the current_user_roles as teacher not TA. (I couldn't get the non-truncated links.  Important part is the current_user_roles)

window.ENV.current_user

Object {id: "49319", display_name: "Joni TA Miller", avatar_image_url: "https://secure.gravatar.com/avatar/f0a465be979b489…structure.com%2Fimages%2Fmessages%2Favatar-50.png", html_url: "https://seminolestate.test.instructure.com/about/49319"}avatar_image_url: "https://secure.gravatar.com/avatar/f0a465be979b4899ecbd69535e658772?s=50&d=https%3A%2F%2Fcanvas.inst..."display_name: "Joni TA Miller"html_url: "https://seminolestate.test.instructure.com/about/49319"id: "49319"__proto__: Object

window.ENV.current_user_id

"49319"

window.ENV.current_user_roles

["user", "teacher"]

shouldn't it be showing TA?  If so, this is NOT good...

[cms_hickss]

You should add what you've found to your open ticket. Since it seems like we're going to have to help support along on this one.

[millerjm]

I tried and I was told "contact your csm only an ic or your csm can help with this"

[millerjm]

I just got an update on my ticket and engineering is looking at it.  Hopefully this will be resolved soon!

[millerjm]

I'm wondering why this is "assumed answered" since it is an unresolved issue?  Is there an ETA on this being fixed? 

[Stef_retired]

 @millerjm ​, the question is marked "assumed answered" because the solution cannot be provided by members of the Community; the matter is now in the hands of Canvas Support. Normally, questions that require the intervention of Canvas Support are marked "assumed answered" or "correct answer" (if the answer given by the Community is on the order of "submit a help ticket"). Of course, the members of the Community would appreciate knowing the resolution of your ticket if and when you have received an update and have time to post it.

[millerjm]

Thanks for the explanation, Stefanie!

[millerjm]

Today's update from Instructure Support: 

Unfortunately, we do not have any updates on this issue as of yet. It is still an open issue our engineers are aware of, but we currently do not have any updates.

[millerjm]

Is it possible that this change is what gave the TA Role the ability to make changes to course settings? 

     Commons Release Notes (2015-11-23)

Has there been any news related to this issue?

[millerjm]

Has there been any updates to this?  It's still a big problem and we have had no updates in quite a while... Thanks!

[millerjm]

This is the follow up I got today after asking for a status update on JIRA CNVS-14150

Thank you for contacting Canvas support. This Jira is still unresolved. This case is attached to the JIRA so when a fix is deployed you will be notified. Please let us know if you have any additional questions; happy to help

[zxc09]

Do we know this has been resolved?