instructure / canvas-lms

The open LMS by Instructure, Inc.
https://github.com/instructure/canvas-lms/wiki
GNU Affero General Public License v3.0
5.41k stars 2.42k forks source link

Access to files in folder restricted via token authentication #2306

Open Beebeeoii opened 5 months ago

Beebeeoii commented 5 months ago

Summary:

There appears to be a weird issue where a API token (generated by Canvas) is forbidden to access files in some folders, but granted access when the user logs in normally via the website.

Steps to reproduce:

  1. With a token, access the endpoint /api/v1/folders/{folderID}/files
  2. Greeted with the following response:
{
    "status": "unauthorized",
    "errors": [
        {
            "message": "user not authorised to perform that action"
        }
    ]
}

Expected behavior:

The files within the folder should be visible, since it is if the user was to log in normally.

Actual behavior:

Greeted with an error 403.

Additional notes: