INC-191902 · Issue 677412
Updated security for importing Excel to a decision table via a delegated rule
Resolved in Pega Version 8.7
An error was seen when attempting to import an Excel file into a delegated decision table when using the case manager portal. This has been resolved by correcting a BAC issue for decision table import in the pzRuleDeclareDecisionTableStandard.js file.
INC-172521 · Issue 651553
Email template content visible in user application
Resolved in Pega Version 8.7
An issue was seen with email templates functionality where the body content given during the email template creation was not visible when the template was used in the application by an end user. This was a missed use case for recent security updates, and has been resolved.
INC-178116 · Issue 660565
Article on configuring display options for a harness updated
Resolved in Pega Version 8.7
The documentation around the load behavior of a harness has been updated to reflect that the initialization settings only apply when using the harness as a landing page from the channel config. Applications that use Cosmos React do not use harnesses for landing pages. You can modify Cosmos React landing pages only in App Studio.
INC-176158 · Issue 664348
Max number of rows setting properly honored
Resolved in Pega Version 8.7
The setting for the maximum number of rows to retrieve was still used in a report definition even when it was disabled. This was traced to the report definition being sourced from a data page and having pagination enabled, and has been resolved by updating the handling for this use case.
INC-170514 · Issue 653762
Lock conflict resolved for AssignmentCheck
Resolved in Pega Version 8.7
The error "Unable to unlock this work object" sporadically appeared in both the runtime log and Pega RULES log when the robot was trying to create a case in Pega using an API call. Investigation showed that as the case was created, it was pulled by another robot (another requestor) which was using the GetAssignments API. This caused the perform assignment check to fail. To resolve this, a 'when' rule has been added to the performAssignmentCheck Activity.
INC-187350 · Issue 703199
UUID added to iOS direct photo upload to differentiate filename
Resolved in Pega Version 8.7.2
When "Content Storage" with the option "Store in repository" was enabled on the "Integration" tab in the Application definition, it was not possible to add more that two attachments to a case with an iPhone when directly capturing a photo through the camera app instead of uploading the photo as an attachment using the gallery. When using the default "Store in Pega database", the additional photos could be uploaded directly from an iOS camera without any errors. Investigation showed that when "Store in repository" was enabled, a file name conflict check was done in the repository. Because the iOS camera app saves/uploads every image as "image.jpg", this caused the error when checking for a filename conflict in the repository. This has been resolved by adding code to append a UUID to the attachname when the device is mobile and browser is Apple Safari.
INC-193561 · Issue 680427
Client secret made optional for JWT Bearer Grant type
Resolved in Pega Version 8.7
After update, trying to connect a REST API using OpenAM as the provider for OAuth and using JWT Bearer as Grant type was resulting in an error indicating the request was not reaching the destination. This was traced to the client secret being designated a mandatory field when it should be optional in this case as the required key store was already configured with a JWT token profile. To resolve this, an update has been made which will make the client secret optional when the authentication scheme is JWT Bearer. In addition, the blank value caused a null pointer error when the client secret was not passed. This has been handled with a check.
INC-177665 · Issue 662020
Security updated to allow Access group switching
Resolved in Pega Version 8.7
When a member of two different access groups attempted to switch from one group to another, an "access denied" message occurred. This was traced to the use of BAC, and has been resolved by updating the pzProcessApplicationSwitch activity to use the pzEncryptURLActionString function to register the request.
INC-186868 · Issue 675245
Security updated to allow Access group switching
Resolved in Pega Version 8.7
When a member of two different access groups attempted to switch from one group to another, an "access denied" message occurred. This was traced to the use of BAC, and has been resolved by updating the pzProcessApplicationSwitch activity to use the pzEncryptURLActionString function to register the request.
INC-176205 · Issue 655938
Secure shared link generation added to scheduled reports
Resolved in Pega Version 8.7
When a scheduled report with a link was sent in email, clicking the link displayed an access denied message. To support this use, logic has been added to pytaskoutputprocessor in the pega-scheduledtask-reporting and pega-scheduledtask classes that will create a secure encrypted URL using the PublicLinkURL function.