Hello,
I noticed some different behavior recently in canvas when an image or link to a file is imported from a course. I'm not sure when it started, but I know that it must be in the past few months because this was not the behavior that I have seen in the past.
Upon course import of content into the recipient course, the recipient course no longer rewrites the data-api-endpoint attribute of images or files, but the actual source of the file or image does get rewritten.
I haven't done enough testing to see if this is an issue or not, but I would imagine that if canvas looks at this data-api-endpoint attribute instead of the actual source, it could return images/files that aren't associated with the recipient course.
For example, the newly noticed behavior looks like the following code upon import (notice the data-api-endpoints do not match the source)
Example 1:
OR
Example 2:
I would assume that the code should look like the following examples (notice the data-api-endpoints match the source)
Example 1:
OR
Example 2:
4130/files/2974818" data-api-returntype="File" />
Has anyone else noticed this behavior? Should I be concerned that my files and images aren't being correctly served to my students? Should I be concerned about any kind of external tool using the data-api-endpoint? Something tells me this has cascading implications.
