In crafting my pages today, I noticed some things I had created using the inline "position: fixed" rule are being overwritten on save to "position: relative". Even trying to bypass this issue through a css rule has the editor adding "position: relative" to my code.
Why is this happening? There is nothing in the Allow List that says position: fixed is banned. I see nothing about it in release notes.
All I know is that I had some awesome modals that relied on "position: fixed" and they no longer work and it sucks. I try sooooo hard to make my courses awesome and engaging with what little I can do as a non-admin in a district that does not pay for CidiLabs and Canvas is always messing it up. I hate this CMS. 😢
So, I went to the repo for Canvas and found that YES, position:fixed has been banned, see the following commit:
It would be great if Canvas updated the allow list to make this explicit and also provided some more details about the "security vulnerability," since we obviously don't have access to their JIRA to see it ourselves.