Zoom Meeting plugin - Preventing access of students to recordings

[acquaalta]

Hi @jrchamp,
I don't know if it's a question, bug report or a feature request, and I'll let you decide.

Please see the following scenario:

• The Zoom Meeting activity is set to show recordings to the students, and a recording is available.
• The student can access the recording using the details shown in the Zoom Meeting plugin, meaning the recording URL and passcode.
• The teacher hides the recordings in the Zoom activity.
• If the student has the recording details (URL and passcode) kept, he can still access the recording.

Isn't there a way, using the Zoom Meeting plugin, to prevent the student from accessing the recordings?
The Zoom LTI tool has a publish/unpublish feature, while it seems that the "Zoom Meeting" plugin only hides the recording details, which helps only if the student doesn't already have the details.

Maybe I'm misunderstanding something. Please shed some light on this issue.

Thanks 🙏

[jrchamp]

Hi @acquaalta,

You are correct. A student who has the recording details can access the recording even if the details are no longer visible. The only way to prevent someone from accessing the recording would be to change the recording details, specifically, changing the sharing settings.

The LTI tool is probably changing the "Who can view" setting in Zoom to implement that "publish/unpublish" feature, switching it from "Everyone with the recording link" to "Nobody else can view". There are other ways that they could implement this, but this is a sufficient example. Unfortunately, this means that the LTI tool requires the recording:write:admin scope which grants full control over all recordings (changing sharing settings, deleting recordings, etc.).

With this plugin, we try to minimize the level of access/risk that is required for you to use the plugin. We've never asked for write access to recordings, so if that functionality were added, I would advocate for it to be optional and not required. Additionally, I would encourage whomever implements the change to be careful about changing the "Who can view" setting, because it may already be limited to users that are part of the account, so it would be difficult to toggle between a custom access group and the no access group.

In summary, it sounds like this is a feature request for:

• Add webservice call for PATCH /meetings/{meetingId}/recordings/settings
• Add optional scopes cloud_recording:update:recording_settings:admin / recording:write:admin
• If the optional scope has been granted, allow a recording to be "unpublished/published", likely be toggling the share_recording between none and publicly. Alternatively, consider letting people choose between none, internally and publicly.

Would something like this meet your needs? Do you have any additional questions?

[acquaalta]

HI @jrchamp,

1. Tttthhhhaaannnkkkksssssss a lot for your quick and detailed answer 😃 🙏

2. Something like this would completely meet our needs, If I understood your idea in general.

3. You wrote "so if that functionality were added, I would advocate for it to be optional and not required", and I completely agree with you.

4. The only thing that I'm not sure that I understood is the following text:
   "I would encourage whomever implements the change to be careful about changing the "Who can view" setting, because it may already be limited to users that are part of the account, so it would be difficult to toggle between a custom access group and the no access group".
   Could you please clarify it?

Thanks 😃

[jrchamp]

Hi @acquaalta,

Thank you so much for your timely and friendly response. ❤

To clarify: I am encouraging the Moodle plugin developer who works on this issue to be careful when designing the functionality. For example, in my environment, my recordings are only accessible by people that are part of my organization. A developer might incorrectly assume that recordings are only private or only completely public, which is not true. So, in my summary, I suggest investigating the share_recording setting which appears to only have three possible values. Three is a manageable number of options and would give instructors the power to decide which option they want.

[acquaalta]

Thanks a lot, @jrchamp :-)