SR-D63976 · Issue 524220
Double decompression of Attachment BLOBs corrected
Resolved in Pega Version 8.3.2
Attachment streams were being double-decompressed on download. This was traced to the GetAttachmentReference activity in which the file was opened then performing a show-html of DisplayAttachment HTML. This internally called the DisplayAttachFile activity which attempted to open the file again, resulting in a double de-compression of the attachment BLOB. This has been corrected.
SR-D64506 · Issue 529333
Improved accessibility around page landmarks
Resolved in Pega Version 8.3.2
Accessibility testing revealed an issue with pages where the main landmark was contained in another landmark. This has been resolved by removing the main role in the FlowActionHTML rule.
SR-D65513 · Issue 530181
URL encryption modified for ShowAllOperators
Resolved in Pega Version 8.3.2
In the control ShowAllOperators the call to pzEncryptURLActionString was introduced to encrypt URLs to avoid hijacking. The content of the URL relied on the pxRequestor.pxWorkGroup property which was resolved using pega:reference tags. This approach worked in versions below 8.x, but in higher versions the tags were not resolved at runtime and results were not displayed. To resolve this, the requestorWorkGroup will be treated as string and passed as parameter instead of using pega:reference tags.
SR-D67323 · Issue 529946
Cross-site scripting filtering added for CreateMergedWordDoc
Resolved in Pega Version 8.3.2
Cross-site scripting filtering has been added for the TemplateName parameter value in the CreateMergedWordDoc section.
SR-D79113 · Issue 543721
Updated DisplayAttachment to handle SIngleClick download from Case Worker portal
Resolved in Pega Version 8.3.2
On using the script "pega.ui.HarnessActions.doAttachmentSingleClick" in the Worker portal to download attachments displayed within a screen flow, the entire application was hanging and no action was invoked even on clicking the Continue or Finish buttons of the screen flow. Whenever an attachment is downloaded using the script function pega.ui.HarnessActions.doAttachmentSingleClick() , an iframe is used and changetracker is called to communicate data between different iframes. However, the case worker portal is a single thread model while the manager and admin portals are multi threaded, which resulted in changetracker freezing on the worker portal. To resolve this, the DisplayAttachment HTML rule has been updated to build the necessary changeTrackerMap for the worker portal.
SR-D80120 · Issue 544213
Custom attachment category parameter passed to dropdown
Resolved in Pega Version 8.3.2
Attempting to use the out-of-the-box “Attachments control” which was configured at design time to use a custom category where both the custom category and the section class were in the same work class resulted in the attachment category dropdown defaulting to “File” instead of the custom category. Investigation showed that the custom attachment category name configured on the control was missing in one of the pre-processing activities sequence. To resolve this, the activity Work-.pzInitAttachContent and the initAttachmentPage activity have been updated to pass the custom attachment category parameter.
SR-D40662 · Issue 511396
OpenRuleAdvanced updated
Resolved in Pega Version 8.3.2
After upgrade, the Update Page and Append and Map to step in Data transform was generating the error "No Server connection while giving page name to Target and Source". This was traced to the OpenRuleAdvanced_OverLabel control, and investigation showed that a variable was not being resolved when invoking pzEncryptURLActionString. This has been resolved by updating OpenRuleAdvanced and reimplementing two parameters as well as moving the call of these variables to the beginning of the script. Security has also been improved by moving some of the encryption to SafeUrls.
SR-D41636 · Issue 521731
Route to configuration in the approval flow accepts Specific User parameters
Resolved in Pega Version 8.3.2
Route to configuration in the approval flow was not accepting a parameter value/property value when select Specific User option from drop down was chosen. This was traced to unique ID change work done in the 8.2 release: the pzSimpleApproval section has two controls (DropDown for Participant & AutoComplete for Operator) configured on same property pyOperatorToAssign with "run visibility on client configuration), and when the control value was being changed in the AutoComplete control, the empty value of DropDown control was being posted to the clipboard. To correct this, the section Work-.pzSimpleApproval has been modified to remove performing run-visibility conditions at client side. Instead, the system will use the ".pyApproverType Changes" condition to refresh the wrapper DL which contains the routeTo type Operator/WB/Participant property controls.
SR-D42566 · Issue 512871
ApplicationInventory function deleted
Resolved in Pega Version 8.3.2
It was possible to call the activity "ApplicationInventory of class Rule-" by appending the activity name in the URL. To improve security, the ApplicationInventory activity and HTML rule have been removed from the system.
SR-D44942 · Issue 518352
Guided tour popups handling added for right-to-left language locales
Resolved in Pega Version 8.3.2
Guided Tour Popups were still appearing in the default EN location after switching to the ar_AR locale. This was traced to a missed use case for locales using a right-to-left mode such as Arabic or Hebrew, and has been resolved by updating the guided tour engine openPopOver function to account for the HTML tag dir attribute for value of "rtl". This will anchor the pop over to rightBottom / and display the arrow on the rightTop instead of leftBottom / leftTop.