SR-B77020 · Issue 326989
Help file update to clarify Precondition exceptions do not have error handling
Resolved in Pega Version 7.3.1
The rule-/rule-obj-/rule-obj-activity/stepstransition help file documentation has been corrected to indicate the Exception handling does not cover any conditions that might occur in the precondition.
SR-B56648 · Issue 315674
Added security check when running out-of-the-box reports with ShowSelectorView
Resolved in Pega Version 7.3.1
A security issue was found where non-authorized users were able to access the out-of-the-box report details in their portal by manipulating the URL to pass a "short-cut" parameter that executed the Final "ShowSelectorView" activity. To avoid the need to set the explicit privileges manually, the ShowSelectorView activity will call a security check to prevent this.
SR-B15150 · Issue 286741
Online help updated with current reindexing utility information
Resolved in Pega Version 7.3.1
The online help files have been updated to remove references to deprecated activities for reindexing declarative indexes. Information has been added for the currently supported utility, the column populator tool (prpcUtils or prpcServiceUtils) with expose option and 'expose.reindex=true', that specifically regenerates declarative index content.
INC-174435 · Issue 659479
Survey Complex Question Definition properly displayed
Resolved in Pega Version 8.4.6
Selecting any Complex Question to look at the definition displayed a blank screen. This was traced to an issue with the ruleformtabs properties for the layout group used by complex questions, and has been resolved by changing the Layout Group display type from "Default" to "Tab".
INC-175533 · Issue 678911
Improved Page compare for page groups
Resolved in Pega Version 8.4.6
Field level auditing on embedded properties sporadically did not report the "old" value when a property was modified even though the page was listed as "Modified". This has been resolved by adding logic to the pxComparePages algorithm to treat Lists and Groups differently. Now Page and Value Groups will use pxSubscript as the primary way to detect add and deletes.
INC-180603 · Issue 661739
Added protections for GetSiblings
Resolved in Pega Version 8.4.6
Cross-site scripting protections have been updated for the GetSibling activity.
INC-182248 · Issue 665782
Added logic to handle manual validate rule creation
Resolved in Pega Version 8.4.6
Manually creating a Validate rule with conditions and then opening the configure view with conditions caused the validation rule to be removed from the flow action rule along with the validation conditions in the validation rule referred in flowAction rule. This has been resolved by updating the logic in the Condition Builder to handle this use case.
INC-191567 · Issue 676158
New application wizard security updated
Resolved in Pega Version 8.4.6
Security around displaying and running the new application wizard has been enhanced.
INC-175706 · Issue 659527
SSLContext created using protocol from REST connector rule form
Resolved in Pega Version 8.4.6
After upgrading to IBM websphere v9.0.5.6 or higher, API calls Like REST, Connect-HTTP etc were failing to connect to endpoints using TLSv1.2. Investigation showed that although the connector was configured to send TLSv1.2, the ClientHello handshake was triggered for TLSv1.3. Because the SSLContext was created with highest version supported by protocol in the WAS container, this has been resolved by modifying the code to create SSLContext based on the the protocol selected in the REST connector rule form. Additionally, please note that the Connect-HTTP connector has been deprecated and the Connect-REST capabilities in the platform should be used instead.
INC-179360 · Issue 662178
Check added for allowed editing with CSRF
Resolved in Pega Version 8.4.6
After enabling CSRF, it was not possible to edit a data table used to define ACL rules due to security preventing the adding/editing of rows and user group entitlements. This has been resolved by using browser FingerPrint validation to check whether an activity is in a secured list and skipping validation for allowed activities.