Update on the Known Issue Related to Course Files in Item Banks

[AlexSlaughter]

Update 6/28/2024

Now that file verifiers have been restored, we are moving forward with the long-term fix. We are still on track for the promised late September timeline.
Since our update last Friday we have heard from some of you that things aren’t working as expected. Please contact support so that they can get more information from you and we can investigate.

Update 06/21/2024

Good news! We have deployed the fix that will restore functionality available before February 2024 to production. This fix is behind the “Use file verifier authentication for New Quiz file links” feature option that is now visible in account settings. The default for the feature option is “enabled.” Administrators will need to disable the feature flag if they do not want verifiers to be added to newly generated or newly copied content.

Update 06/14/2024

By June 21st file verifiers and the feature option will be available in production environments. This will restore functionality available before February 2024 when they were initially removed. This fix will alleviate most issues related to newly generated and newly copied content, including blueprint.

Once available in production environments,  the “Use file verifier authentication for New Quiz file links” feature option will be visible in account settings. The default for the feature option is “enabled”, admins not interested in having file verifiers on, will need to disable the feature option.

With the feature option disabled, new verifiers will not be added but any existing verifiers will continue to work. With the feature option enabled, when you insert new files, the verifiers will be added to course files. If this flag is disabled, using user files is still a viable workaround,as file verifiers have remained in place for user files.

Looking forward, a more general solution is being implemented that does not rely on file verifiers, when this is in place, all existing content will be updated to take advantage of this solution.

Update 05/31/2024

We have some important updates to share on our progress over these last two weeks.

We have decided to restore the functionality of the file verifiers temporarily in order to alleviate the associated concerns as soon as possible. We understand that for many of you this is welcome, but for others it may not be, given the security concerns we previously referenced. Therefore, we are allowing institutions to opt out of file verifiers in New Quizzes via a root account flag that can be turned off by an administrator. The reason we have chosen to go this route is that we have determined that our longer term solution will not be ready as quickly as we’d hoped. While this is not ideal, we do believe it’s the best way to improve the current situation as we work to resolve it longer term. We will enable file verifiers as soon as possible, at which time we’ll document the process to turn off file verifiers if your institution chooses that option. 

For the longer term, we're pursuing a solution that will solve two important problems:

• Files will still be available in quizzes, even if the file’s original context (course or user) is deleted.
• Files in shared item banks will be available regardless of if the user is enrolled in the file’s source course. 

We are targeting a late September release for the longer term solution, which will also ensure all old links are corrected.

Please stay tuned for the next update in two weeks.

---

05/17/2024

The most recent New Quizzes update sparked a lot of feedback, much of it expressing frustration about the known issue related to course files in item banks. Copying a course does not automatically change the links in an item bank, so when you use a question from an item bank in the new course, the links would still refer back to the original course. We know you’ve been anxious for a response, and have appreciated your patience as we’ve investigated internally on how to remedy this issue and to make sure we fully understand the timeline so that we can provide clarity here.

When did this issue begin?
We want to be clear that this was an existing issue, as we stated in September 2023, when we added warnings into the workflows to make sure that educators were aware of the limitations and would hopefully leverage the workaround. We have had this on our roadmap to fix, but had not yet addressed it when we unintentionally exacerbated the problem in February 2024 by removing “verifiers” from file links in rich content. 

What are file verifiers and why did we remove them?

Simply put, a file verifier is a secret access token we attach when granting access to a file through a special pathway (i.e. the standard course files linked in course content workflow). When we added files to New Quizzes, these verifiers were inadvertently added and masked the underlying issue with item banks, making it harder for both users and us to recognize the problem's full extent. As a result, a proper workflow wasn’t developed. 

After the RCE change was implemented in New Quizzes, teachers started reporting a security concern: the presence of these verifiers allowed students to access locked files within quizzes, which shouldn't have been possible. In resolving the security issue, it revealed the full extent of the problematic item bank workflow. 

What are we doing about it now? 

We are making this a top priority and currently have engineers working on a solution. Given the security concerns, we decided that adding back the verifiers was not a viable option and are implementing a solution that will rectify the underlying issue that removing them has exposed. We have chosen to move forward with a solution that allows New Quizzes to add a new type of verifier which addresses the pitfalls of the previous version of the verifier without reintroducing the previous security concerns. This change does not require a datafix will now be included as part of the solution. So once the change is deployed, the expected behavior will return for all linked content.  

Our commitment to you

We understand the urgency of this problem and want to make sure you feel we are taking this seriously. While we can’t provide a specific resolution date quite yet, we are committed to posting updates to this blogpost every two weeks on the progress we are making until this issue is resolved. 

[JuliaDohr]

Is there a best practice workaround, such as adding the quiz images to an unpublished folder in the Blueprint course and syncing them down to all associated courses? Would the images then appear in the quiz? Kind regards

[dbrace]

What is the timeline for resolving this?

[llettie]

Our CSM informed us that a fix was deployed for this.   Have not had a chance to test yet. 

[TiffanyStull]

Will the fix to the image link migration also address the similar issue with course imports and LTI tool embeds?

We have had cases where instructors embedded media from an LTI tool (e.g., Kaltura, Panopto) in a New Quizzes quiz, and then imported the quiz to another course.  In this case, the media could still be played by the instructors because they were members of both courses, but it was inaccessible to the students in the new course while they took the quiz.

I submitted a ticket about the issue to Canvas Support (Case #10178555) in October 2023, and I was told it was being investigated, but the ticket has been "On Hold" since then with no updates.

[AprilBellafiore]

Hello - Can anyone share what "a fix was deployed for this" means and how we can test it?

We have a summer course that I was manually going to adjust and would love to not have to do this if a fix has been implemented.

[lph]

As a suggestion, a potential answer is to allow the Rich Text Editor to edit the file attributes of the images within the image options dialog box. Currently, a user can change alt text, display options, and size.

Maybe consider a means to include the path information for the course associated with the image, as well as editing permissions as if the user is in the Files --> Upload Media folder. 

A huge challenge is for teachers who make copies of their shells each year and may not have access to these after the course has ended. Therefore, in the editor, add the ability to copy the image file to the new shell which updates the course number. 

Yes, programmatically, you're in a pickle because teachers will want this to automatically be done for them. However, giving control might alleviate challenges in the future and end the ongoing frustration.

Also, under the file editing permissions, there needs to be better information regarding "inherit from course" if the teacher doesn't know what is being inherited. Add clarity by explicitly stating what is being inherited.

At least you've made this a priority. 

[jwillin]

Hi,

Testing this today, 5/29/24, the image issue appears to be resolved when using Chrome but is still broken when using the latest version of Firefox. I am on a PC.

Thank you,

John Willingham

Educational Analyst II

Teaching and Learning Technologies

Emory University

404-576-2777

[AllisonHowell]

Hi JuliaDohr, for a blueprint course, the workaround we suggest is, instead of dragging and dropping the images into the RCE, they should upload the media to their user folder. That being said, once we put the file verifiers back (see update above), this should be less of an issue and the workaround may not be needed.

[AllisonHowell]

@dbrace llettie AprilBellafiore Please see our most recent update above. We've decided the best path forward is a "short-term" fix that will be deployed ASAP and for our longer term solution we are targeting late September.

[AllisonHowell]

@TiffanyStull Unfortunately this issue is separate from the one we're talking about above. It's something we're aware of and has come up as we've worked on the file link issues, but it still needs additional planning.

[AllisonHowell]

lph Appreciate your thoughtful suggestion and will share with the engineering team currently working on the issue. 

[LauraJiménez]

Hi @AllisonHowell 

We did some testing and found out that when creating the item banks from the subaccount instead of the course, there's not any issue with the images when syncing the blueprint with its related courses. Would that be another workaround? Is that something you guys have been able to test?

Thanks in advance!

[JuliaDohr]

Dear @LauraJiménez 

In our institution, only swa have access to subaccount management, so item banks couldn't be managed centrally via that option. I think a Blueprint course would be the right place to build a proper item bank for a module. Here all Blueprint course admins have access and the environment is stable. Otherwise, there would be a need for a third option where a team of people could access an item bank outside of any subaccount settings or blueprint courses.

Kind regards
Julia

[aolsonpacheco]

Does the newest update mean that the link validator will now work for identifying item bank images that may be referenced from other courses?

To determine which item bank images might not be visible to students, we tried the link validator, and none bank images were flagged (even though we knew some were not visible to students). 

[ldavenport4015]

@AllisonHowell Re: Blueprint course that uses Item Banks with images:

Can you clarify your answer to @JuliaDohr? For the work around, if the instructor in the Blueprint course has created the quiz in the Blueprint course using Item Banks with User file images, then will the associated courses show the images to the students in the quiz questions? Does the User have to be in the associated courses as an instructor? 

Thank you for the clarification. 

Lynn

[AllisonHowell]

@ldavenport4015 The user does not have to be in the associated course as an instructor, as long as it's a user file that has been made public. 

[AllisonHowell]

@aolsonpacheco Unfortunately, given how quickly we are trying to remediate the current issue we have not been able to address the link validator with this work. 

[MPioRoda]

@LauraJiménez When you open item banks from the account level and start editing banked quizes, the RCE does not let you add course files because it doesn’t know what course to pull from.

We recommend the original workaround given in the older blog post: If someone wants to put an image in item bank content (as part of a question), they are either loading it from their user files or from their course files. If they are loading the image from their own user files, as long as they set a user file as readable, then the links will work in item banks when they copy a course.

[lph]

@MPioRoda 

That work around doesn't work if the original canvas shell is removed because the district doesn't want to keep older shells. A few weeks ago, I was working with a teacher who copied a copy of a copy (6 times over 3 years) and none of the links worked. They all pointed to the original from three years ago. Our district already made a decision to remove older shells (to save space) and it caused a huge headache. Luckily, backups were restored. 

My point is that canvas developers should never assume an older shell will exist past the end date. Older canvas shells will eventually disappear. 

This is why I advocate for a teacher to create a "master" or "blueprint" canvas course manually. This is kept on their dashboard but never published. If using a master, then a district created shell at the start of the semester has the students populated and therefore the content from the master is copied into the new shell. Additionally, some teachers have a "blueprint" and so the new shells are associated to the blueprint and sync is done. Otherwise, teachers in the long run are going to be up the creek. It depends on the teachers' skill level. 

[aolsonpacheco]

@MPioRoda I'm wondering if there are any drawbacks to instructors loading quiz bank images in their account files. For example, if an instructor wants to share course materials with another instructor, will the images still be available to students if they are associated with a different instructor's account?

@lph Can you help me understand how copying from the "master" course would correctly show quiz bank images when copying from a previous course may not (when the course still exists and is not removed)? We are seeing images not showing up for students even when the original course still exists and is published. I am debating whether to have instructors upload images to their user account files vs. creating a Master course. 

[TiffanyStull]

@AllisonHowell how will the solution of placing content in a user's files work when there are staffing changes? If a user's account is deleted due to them leaving the institution, I assume the embeds will stop working because the files will be considered "deleted" unless the account is restored from deletion, is that correct?

Unfortunately, using public links for quiz or images is not a very desirable solution in terms of assessment security. Ideally, no one other than instructors/TAs/course designers would have access to any assessment images at any time when the viewer does not have permission to access the assessment in question.

Copyright restrictions should also be taken into consideration whenever providing a workaround that requires a user make content publicly viewable.

[LauraJiménez]

Hi @MPioRoda 

Regarding your reply:

---

@LauraJiménez When you open item banks from the account level and start editing banked quizes, the RCE does not let you add course files because it doesn’t know what course to pull from.

We recommend the original workaround given in the older blog post: If someone wants to put an image in item bank content (as part of a question), they are either loading it from their user files or from their course files. If they are loading the image from their own user files, as long as they set a user file as readable, then the links will work in item banks when they copy a course.

---

Is there any reason to avoid creating the Item Bank at the subaccount level? It seems a valid workaround, since managing user files might be tricky if the user stops collaborating with the university and their user account is deleted.

We just want to make sure we understand why creating the Item Bank at the subaccount level should not be an option and we're not missing anything out.

Thanks!

[JuliaDohr]

@LauraJiménez, 

I agree - also with regard to Blueprint Admins who may prepare quizzes in a local Item Bank while not necessarily also being members of the associated courses. Here the "personal files" workaround would also not work. 

kind regards
Julia

[kmoore2431]

I see that they updated this on 06/21/2024 with a "fix" but I am still running into problems. I tried copying over a course from the Winter quarter and the pictures are still not showing up in the student view when you try taking the quiz.