INC-206782 · Issue 701142
BAC updated for delegated circumstanced decision table rule
Resolved in Pega Version 8.6.4
An unregistered request error was encountered while launching the DelegatedRulesPage harness when pyBlockUnregisteredRequests >=1. This was traced to a delegated circumstanced decision table rule which caused a request error for the @baseclass.pzLookupCircumList activity, and has been resolved by updating the BAC handling for this activity.
INC-207210 · Issue 703701
Empty check added to OpenRuleAdvanced
Resolved in Pega Version 8.6.4
A blank screen was displayed when attempting to open a requirement set rule in Dev Studio. This was a missed use case while updating the OpenRuleAdvanced control to handle BAC compatibility, and has been resolved by adding an empty check in addition to the existing null check along with an 'if' condition to check for pyActivity input.
INC-209426 · Issue 706802
GetFunctionsForLibrary retrieves 10,000 rows
Resolved in Pega Version 8.6.4
Some functions were missing from the expression builder browser and search results when pyShowInternalLibrary was set to true for including internal functions in the results. To resolve this, the default value for "Maximum number of rows to retrieve" in pzGetFunctionsForLibrary has been increased to 10,000.
INC-213625 · Issue 712297
Corrected null values being set to 0 in GenerateExcel
Resolved in Pega Version 8.6.4
The pxGenerateExcelFile activity was loading $0.00 in place of a null value for decimal columns. This has been resolved by updating the logic for GenerateExcel.java to skip double properties default value for non-existent clipboard props and extend the same fix to the integer class. Safety checks have been added before setting cell type to check if property exists, and handling has been added for a specific exception instead of generic exception for both decimal and integer use cases.
INC-164432 · Issue 696294
Global obfuscation key initialized on first requestor call
Resolved in Pega Version 8.6.4
When using URLEncryption = true and SubmitObfuscatedURL = optional, attempting to export an Excel spreadsheet resulted in the error "Invalid character found in the request target". This was traced to the variable pega.d.globalobfuscateKey having a null value which was then converted to a byte array and decoded, generating improper characters in the URL. After a browser refresh, the correct value was set in pega.d.globalobfuscateKey and the export worked as expected. To resolve this, an update has been made to initialize the key on the very first call in PRRequestorImpl when the global obfuscation key is determined to be NULL instead of initializing the global obfuscation key by on-demand basis from HTTPAPI.
INC-182827 · Issue 691528
URL security updated
Resolved in Pega Version 8.6.4
Security has been updated for URL tampering defense and Rule Security Mode.
INC-209298 · Issue 704141
Added security tokens to Worklist assignment error wizard
Resolved in Pega Version 8.6.4
After enabling CSRF, moving to 'Configure -> Case Management -> Tools -> Work Admin -> Worklist assignment errors' and then selecting a record and clicking on 'Delete' resulted in a '403 Forbidden' error. This has been resolved by adding CSRF and fingerprint tokens as part of the form data.
INC-211426 · Issue 706061
UI and code changes to support Client Assertion in Open ID Connect
Resolved in Pega Version 8.6.4
In order to support private_key_jwt, an enhancement has been added which will pass the “Client ID” and “Client assertion” (in the form of a signed JWT) as part of the authorization code grant flow for an IDP-initiated SSO. The Authorization Server will then authenticate Pega (the client) to verify the signature and payload of assertion by retrieving the public key via Pega’s JWKS endpoint.
INC-215343 · Issue 711141
Security updates
Resolved in Pega Version 8.6.4
Security updates have been made relating to rulesets using allow lists, checks for Java code injections, SAML-based SSO code, and supporting SFTP as part of the validation in the pxValidateURL rule.