search

instructure / canvas-lms

The open LMS by Instructure, Inc.
https://github.com/instructure/canvas-lms/wiki
GNU Affero General Public License v3.0
5.58k stars 2.48k forks source link

Admins in one sub-account see the complete calendar of courses in other sub-accounts. #2093

Open ana-uib opened 2 years ago

ana-uib commented 2 years ago

Summary:

Given two sub-accounts: A and B an admin in sub account A that is also a student in a course in sub-account B sees in the calendar of the course in B all the calendar events, including the ones of sections that the user is not enrolled in.

Steps to reproduce:

  1. Create sub-account A
  2. Create sub-account B
  3. Create a courseA in sub-account A
  4. Create two sections in courseA: SectionA1 and SectionA2
  5. Create calendar_events for SectionA1 and SectionA2
  6. Make a user administrator of sub-account B
  7. Enroll the same user in SectionA1

Expected behavior:

The user should only see the calendar events of SectionA1 in the course calendar

Actual behavior:

The user sees the calendar events of SectionA1 and A2

Additional notes:

There is a community thread on this issue. The solution currently used is to create several user accounts for the same user.