Engineers are currently investigating the issue.
Summary:
Students that copy the “Course Atom Feed” link are able to follow an RSS that provides information before it is available to the student within Canvas or through API.
Expected Behavior:
Permissions for RSS should match the user or assignments not available should not show before they are available.
Steps to Reproduce:
- Create and publish a course
- Add a student
- Add an assignment with an available date in the future
- From the home page of the course inspect the page and search for “atom”
- Copy the “Course Atom Feed” from the elements and paste it into an RSS reader
- View the reader and you should see assignments and information you should not be able to see.
