INC-164432 · Issue 696294
Global obfuscation key initialized on first requestor call
Resolved in Pega Version 8.6.4
When using URLEncryption = true and SubmitObfuscatedURL = optional, attempting to export an Excel spreadsheet resulted in the error "Invalid character found in the request target". This was traced to the variable pega.d.globalobfuscateKey having a null value which was then converted to a byte array and decoded, generating improper characters in the URL. After a browser refresh, the correct value was set in pega.d.globalobfuscateKey and the export worked as expected. To resolve this, an update has been made to initialize the key on the very first call in PRRequestorImpl when the global obfuscation key is determined to be NULL instead of initializing the global obfuscation key by on-demand basis from HTTPAPI.
INC-182827 · Issue 691528
URL security updated
Resolved in Pega Version 8.6.4
Security has been updated for URL tampering defense and Rule Security Mode.
INC-209298 · Issue 704141
Added security tokens to Worklist assignment error wizard
Resolved in Pega Version 8.6.4
After enabling CSRF, moving to 'Configure -> Case Management -> Tools -> Work Admin -> Worklist assignment errors' and then selecting a record and clicking on 'Delete' resulted in a '403 Forbidden' error. This has been resolved by adding CSRF and fingerprint tokens as part of the form data.
INC-211426 · Issue 706061
UI and code changes to support Client Assertion in Open ID Connect
Resolved in Pega Version 8.6.4
In order to support private_key_jwt, an enhancement has been added which will pass the “Client ID” and “Client assertion” (in the form of a signed JWT) as part of the authorization code grant flow for an IDP-initiated SSO. The Authorization Server will then authenticate Pega (the client) to verify the signature and payload of assertion by retrieving the public key via Pega’s JWKS endpoint.
INC-215343 · Issue 711141
Security updates
Resolved in Pega Version 8.6.4
Security updates have been made relating to rulesets using allow lists, checks for Java code injections, SAML-based SSO code, and supporting SFTP as part of the validation in the pxValidateURL rule.
INC-191371 · Issue 684481
Security update for GetAssignmentDetailsInternal errors
Resolved in Pega Version 8.8
Error handling for pzGetAssignmentDetailsInternal has been updated to return a 403 (forbidden) HTTP status code in place of potentially sensitive information when access is denied.
INC-193700 · Issue 685077
Support added for calling Strategy rule from When Rule
Resolved in Pega Version 8.8
An enhancement has been added to support manually referencing Strategy rules in the When rules using Dev studio.
INC-194330 · Issue 708712
Added special character handling for DecisionTable column-label
Resolved in Pega Version 8.8
The label of a decision-table column was being appended to the original decision-table return-value. The column label and comparator were handled differently for columns containing special characters (+, -, *,...), causing the data after the special character to be trimmed and appended to the row output value. This has been resolved by adding handling for special characters so the output and the label are rendered properly.
INC-195793 · Issue 697920
Enhanced ruleset validation for portal creation
Resolved in Pega Version 8.8
Attempting to create a new portal (web channel) from the app studio using the Creation Wizard with "Branch development preferences" enabled resulted in the error message "No valid rulesets in application preferences". Investigation showed this occurred due to CPM-Portal being specified in the application as the UI class: when attempting to create the portal, the system was evaluating the class against ruleset candidates. The class was not visible to the rulesets in the stack and thus the portal could not be created. This has been resolved by adding validation on UI pages, Int and Data classes in the application to ensure that they exist in user rulesets, and by adding an allowance for classes to exist only in branched rulesets and not the base ruleset during check if the ruleset is present in application stack.
INC-202249 · Issue 693323
Corrected doubled ampersand passed to message rule
Resolved in Pega Version 8.8
In drop down the ampersand "&" symbol was displayed correctly, but passing that value as a parameter to a message rule used in the page-set-messages method doubled the "&" symbol. This has been resolved.