[Inbox] Student users can interact with users outside their section
In the Canvas Inbox, students can message any teacher in their course instead of only having access to the ones in their section. Documentation states when we limit section privileges, the user should only be allowed to interact and see users enrolled in the section specified. This is true for teachers as they can only see students in their section, but it is not true for students. The Canvas Inbox appears to be the only place where users (in this case, students) can see/connect with persons (in this case, teachers) outside their section. Teachers and students are restricted to only seeing other users within their section in every other place we’ve tested. This includes: people page, gradebook, speedgrader, the course itself, etc.
We believe this is a bug Instructure needs to fix, since the functionality contradicts the documentation. Students should be restricted to only see users within their section, which includes the Canvas Inbox.
admin,instructor,student,ta