INC-169310 · Issue 649714
Cache check added for SQL queries
Resolved in Pega Version 8.7
When performing load testing, a high number of gets were seen for some SQL Queries. In order to improve performance, a check has been added in GlobalTrustStoreCacheImpl.java to assess whether the cache has been initialized or not.
INC-164336 · Issue 634151
URL validation updated to handle custom token endpoints
Resolved in Pega Version 8.7
While saving an authentication profile with OAuth details, validation was failing for a valid URL given in the access token endpoint and revoke token endpoint fields. This was traced to the use of the Apache URL validator, which considered some domains to be invalid. To resolve this, the urlvalidator constructor has been updated to include a custom RegexValidator for access token and refresh token URLs.
INC-190384 · Issue 676573
URL validation updated to handle custom token endpoints
Resolved in Pega Version 8.7
While saving an authentication profile with OAuth details, validation was failing for a valid URL given in the access token endpoint and revoke token endpoint fields. This was traced to the use of the Apache URL validator, which considered some domains to be invalid. To resolve this, the urlvalidator constructor has been updated to include a custom RegexValidator for access token and refresh token URLs.
INC-166995 · Issue 642440
DeleteDocumentPg added to allow list
Resolved in Pega Version 8.7
During performance testing with CSRF settings enabled, a '403 Forbidden' error was seen in the network trace when FinishAssignment called pyActivity=pyDeleteDocument on close action. This has been resolved by adding pyDeleteDocumentPg to the list of allowed activities.
INC-185251 · Issue 674906
Locking APIs updated to handle CDK key rotation
Resolved in Pega Version 8.7
it was not possible to save cases for several hours following the CDK key rotation. This was traced to an exception that caused the system to attempt to acquire a lock on the CDK key instance, and normal save behavior would resume after the default sys lock time out period expired. This has been resolved by updating the system to use LockManager APIs to perform a database save with locks.
INC-180594 · Issue 670957
Filtering added for DisableDormantOperators
Resolved in Pega Version 8.7
When running the Disable Dormant Operators agent, many operators were seen which were dormant but not disabled. Investigation showed the activity was fetching all of the operators without filtering the deactivation state. This has been resolved by adding a filter condition in pzDisableDormantOperators to fetch only deactivate state users.
INC-140111 · Issue 594375
CSRF token handling added to Bulk Processing
Resolved in Pega Version 8.5.2
On click of submit button from the bulk transfer screen, the pzbulkprocess harness was loaded and the portal was automatically logged off. Investigation showed that when CSRF was enabled, loading pzBulkProcess failed with a 403 error that resulted in logging off the current session due to a missing fingerprint token. This has been resolved by adding both CSRF token and fingerprint generation logic to pzBulkProcessingList.
INC-163914 · Issue 668846
Improved Agile Studio passivation recovery
Resolved in Pega Version 8.7
When an Agile Studio session was passivated, the error "SECU0008 : CSRF Detected and Blocked" was seen. Reactivating the session resulted in a blank page. This was traced to the clearing of requestor level registrations added for that particular thread, and has been resolved by adding a new flag to identify if a thread is passivated along with the necessary structure for the conditionalized clearing of requestor level registrations based on this flag.
INC-185362 · Issue 668826
Keystore update properly revises the cache
Resolved in Pega Version 8.7
A keystore updated with the latest certificate was not getting reflected in the runtime and the old certificate was getting picked. In a multi-node environment when the new JKS is uploaded in one node, the changes are expected to be communicated to other nodes so that the cache can be cleaned up. In this case, investigation showed that the keystore label was in uppercase and the cache entry was not correctly removed. This has been resolved by adding an update that will convert the cache key to lowercase and maintain uniformity to ensure proper cleanup.
INC-141940 · Issue 601542
Revoke Access Token check removed from OAuth Client Registration
Resolved in Pega Version 8.5.2
When client credentials were implemented, the OAuth 2.0 Client Registration form was designed such that once the instance was created and a token issued, the access tokens were deleted on save. Process changes now indicate that it should be possible to save the form because it may only have History Description/Usage changes made to it and Revoke Token and Regenerate Secret buttons are already available. To address this, the Revoke Access Token check has been removed from the validate activity of Client Registration.