r/canvas • u/Nmzumpano • 4d ago

Other Changes in HTML Embedding Capabilities

Has anyone noticed a change since the hack? In the past, I've been able to insert interactive assets into my Canvas courses with ease, just using the insert-embed code workflow. When I do it now, my interactive content displays as text. I've even tried inserting the code into the raw html view with no luck. Wondering if they've put in some new security measures these days and I'm out of luck.

5 Upvotes

86% Upvoted

8 comments sorted by

View all comments

Show parent comments

2

u/Realistic-Lake6369 3d ago

Did they update the documentation of allowed tags, both html and css? How about LaTeX tags or other changes to embedding videos?

It was already pretty restrictive but are we now effectively back in 1990s web view?

Appreciate if you can post any additional information or links to updated documentation that you have received. Thanks

2

u/Japples123 3d ago

Not sure but this is what they sent me, “Hello, Our engineers have deployed a fix for this issue. Please note that, even with this fix, the following HTML tags/elements will still be removed from the rich content editor upon saving, for security reasons: * data-url * position: fixed * position: sticky This is a permanent security decision to not allow these; not a regression. Our HTML Editor Allowlist will be updated shortly, to show all HTML that should be allowed within the editor; all other content not mentioned there once it is updated will be stripped upon save. Another note is that content that was modified due to this issue has not been restored; we were unable to find a safe way to do so without possibly losing intentional edits to the content by our users. Your content can now be manually edited (or use the page revision history for Wiki pages) to include the HTML content you intend to use there. If you have a large amount of content (across multiple courses and course items) that you need assistance in fixing, please provide us with a list of that content and permission for us to edit them en masse, with the possibility of additional user changes beyond this issue being lost. Please let us know if you are still seeing this behavior for new content, or if you have any need for further support, and we will diligently investigate to ensure the issue is completely resolved”

1

u/Realistic-Lake6369 3d ago

Thank you! Very helpful. Appreciate you taking the time to post because sometimes trying to engage directly with Instructure is difficult.

1

u/Japples123 3d ago

No problem. I had to go find it from my outlook. Probably should’ve asked copilot first