SR-A24598 · Issue 247394
Apache Struts updated for security
Resolved in Pega Version 7.2.1
Apache Struts has been updated to version 2.3.28 to protect against potential security vulnerabilities exposed when Dynamic Method Invocation is enabled, removing the ability for remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
SR-A4613 · Issue 227870
Updated logging for "Obfuscated URL tampering" errors
Resolved in Pega Version 7.2.1
The error "pegarules.util.URLObfuscation) ERROR - Obfuscated URL tampering - unable to derive cleartext data" was being logged when the "cookie/HttpOnly" parameter was set. This was traced to the unobfuscating of data failing at the server end, and the loggers have been updated to print requestor data for better diagnostics.
SR-A4719 · Issue 230767
Fixed improper ID carryover after reset all loggers
Resolved in Pega Version 7.2.1
When a user reset the logs, the same user ID was then being populated in the log entries of master agent and requestor lock exceptions from that point on even when the exceptions were from other users. This was due to the username not being cleared correctly after the reset all loggers operation is done, and to fix this, the reset all loggers functionality has been changed such that no data from main thread is copied onto the child thread(the dispatcher thread).
SR-A8475 · Issue 233560
Fixed Multiselect grid drag and drop
Resolved in Pega Version 7.2.1
When using MultiSelectList Control, if a value was selected and then 'submit' was used to populate the Grid's data, dragging and dropping the Grid's row to some other workbasket did not work. This happened because the clipboard calls the remove property with a symbolic delete when doing a drag and drop. While processing this delete, if the mode of property was unknown the system was unable to look up the property definition in the dictionary, and an exception occurred. To fix this, handling has been added to lookup the definition of the property if it is unknown before removing it.
SR-D37415 · Issue 508967
Parameter page update added to improve backwards compatibility for ShowTestLibraryTab
Resolved in Pega Version 8.2.4
An error was observed on the first attempt to modify the 'when' rule "ShowTestLibraryTab" located in PegaProjectMgmt:08-01-01. Analysis showed the when rule (Always, Never) which was called from this rule was not found, which was an issue traced to the Rule-Obj-When function alias parameter name being changed from "strWhen" to "blockName" in the 8.1 release. Subsequent attempts to save the modified rule succeeded due to step#7 in the Embed-UserFunction.pzPopulateDropdownFBUIParameters activity upgrading the pyParameters page with the latest data. To resolve this backwards compatibility issue, the activity step#6 has been modified to upgrade the parameter name for the Rule-Obj-When function alias.
SR-D38053 · Issue 508225
Upcase case shape will fall back to pyWorkCover if multiple pages are present
Resolved in Pega Version 8.2.4
In the Update a Case shape, selecting "A Single Case" and providing .pxCoveredInsKeys(1) for the With ID field worked as expected, but using the same data transform and selecting either "All child cases and descendants" or a specific child case resulted in no update on the children. This was traced to the findPageByHandle API not returning the most appropriate page, which created an issue whenever multiple pages were present in the clipboard. To correct this, the system has been updated to use pyWorkCover if present.
SR-D40685 · Issue 508810
Custom routing configured in early Pega versions will be mapped to custom on upgrade
Resolved in Pega Version 8.2.4
After upgrade, a configured custom routing option under assignment properties was missing in all assignments. This has been resolved by updating pzUpdateRouting with a condition that will take assignments configured in Pega 6 versions and map them to 'custom'.
SR-D24750 · Issue 507118
Resolved importing PublicFormat file using RuleFromFile Wizard
Resolved in Pega Version 8.2.4
When attempting to create a flow from a Public Format XML file using the Rule From File Wizard, the following error was seen: "Problem invoking function: pega_procom_harvest.performXSLT--(String,String,boolean,HashStringMap)". This was caused by a mapping failure related to the pyComments property in baseclass pega social functionality, and has been resolved with the addition of a new page group property pyComments of type "Data-MO-Annotation-Comment" which applies to "Embed-Rule-Obj-Flow-ProcessModel". In addition, a system property set has been added:'System.setProperty("javax.xml.transform.TransformerFactory","com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl");' to make the security flags work properly in java step of 'transformPublicFlow' activity
SR-D41636 · Issue 509433
Route to configuration in the approval flow accepts Specific User parameters
Resolved in Pega Version 8.2.4
Route to configuration in the approval flow was not accepting a parameter value/property value when select Specific User option from drop down was chosen. This was traced to unique ID change work done in the 8.2 release: the pzSimpleApproval section has two controls (DropDown for Participant & AutoComplete for Operator) configured on same property pyOperatorToAssign with "run visibility on client configuration), and when the control value was being changed in the AutoComplete control, the empty value of DropDown control was being posted to the clipboard. To correct this, the section Work-.pzSimpleApproval has been modified to remove performing run-visibility conditions at client side. Instead, the system will use the ".pyApproverType Changes" condition to refresh the wrapper DL which contains the routeTo type Operator/WB/Participant property controls.
SR-D42402 · Issue 508895
Added differentiated handling for special symbols based on location in the label string
Resolved in Pega Version 8.2.4
While importing an Excel file into a decision table that used custom functions like@string:notequal or equal, label names like 'AlphaPrefix !=AAA' resulted in the error "invalid expression or reference: line 1:28 extraneous input '"True"' expecting {<EOF>, '-', '+', '=', '*', '/'," " . Investigation found that the problem was with the label of the column not handling the the special characters like (‘!=’, ‘<’ , ‘<=’, ‘>’, ‘>=’ ) present in the middle of the label string: the label and default operator were being updated irrespective of the location of the symbols within the string. To resolve this, DecisionTableWorkBookConverter.java has been modified to set the operator only if the special strings (‘!=’, ‘<’ , ‘<=’, ‘>’, ‘>=’ ) are present at the end of the label.