SR-A24598 · Issue 247394
Apache Struts updated for security
Resolved in Pega Version 7.2.1
Apache Struts has been updated to version 2.3.28 to protect against potential security vulnerabilities exposed when Dynamic Method Invocation is enabled, removing the ability for remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
SR-A4613 · Issue 227870
Updated logging for "Obfuscated URL tampering" errors
Resolved in Pega Version 7.2.1
The error "pegarules.util.URLObfuscation) ERROR - Obfuscated URL tampering - unable to derive cleartext data" was being logged when the "cookie/HttpOnly" parameter was set. This was traced to the unobfuscating of data failing at the server end, and the loggers have been updated to print requestor data for better diagnostics.
SR-A4719 · Issue 230767
Fixed improper ID carryover after reset all loggers
Resolved in Pega Version 7.2.1
When a user reset the logs, the same user ID was then being populated in the log entries of master agent and requestor lock exceptions from that point on even when the exceptions were from other users. This was due to the username not being cleared correctly after the reset all loggers operation is done, and to fix this, the reset all loggers functionality has been changed such that no data from main thread is copied onto the child thread(the dispatcher thread).
SR-A8475 · Issue 233560
Fixed Multiselect grid drag and drop
Resolved in Pega Version 7.2.1
When using MultiSelectList Control, if a value was selected and then 'submit' was used to populate the Grid's data, dragging and dropping the Grid's row to some other workbasket did not work. This happened because the clipboard calls the remove property with a symbolic delete when doing a drag and drop. While processing this delete, if the mode of property was unknown the system was unable to look up the property definition in the dictionary, and an exception occurred. To fix this, handling has been added to lookup the definition of the property if it is unknown before removing it.
SR-D91834 · Issue 554425
Related cases of different types properly linked in Case Worker Portal
Resolved in Pega Version 8.5
After creating a case of type1 in the Case Worker portal, creating a case of type2 from the first case showed the case ID of the second case in the Related Work section as expected. However, after clicking on the link of the case ID of the second case from the related work section, the second case opened but the case ID of the first case was not shown in the Related work. The cases were correctly associated when the Case Manager portal was used instead. This was traced to the Case Worker clipboard continuing to hold the previous case ID thread, and has been resolved.
SR-D71475 · Issue 538721
Check added to apply values of newAssignPage.pxFormName
Resolved in Pega Version 8.5
After upgrade, trying to open existing assignments resulted in a different harness being opened. This was traced to changes in how the property newAssignPage.pxFormName was used, and has been resolved by checking whether the harnesspurpose is dynamic before setting the pxFormName. If formname is already present, the system will proceed with picking the harness from the shape.
SR-D63307 · Issue 542770
Unneeded class name filter removed from GetRelevantPropertiesForDataType
Resolved in Pega Version 8.5
Given one class with a set of properties and another class inherited from the first class containing a relevant records set for class 2, then a new harness did not show the base class fields. Investigation showed that the fields present in the parent class and marked relevant in the case were not being fetched due to pzGetRelevantPropertiesForDataType having a class name filter along with filter by rule resolution. To resolve this, the class name filter has been removed as it is not required due to the report already filtering by rule resolution and relevant class through a join.
SR-D61681 · Issue 532561
Handling added for different access groups updating a case
Resolved in Pega Version 8.5
When a parent flow was configured with a Wait shape to wait until any AccessChild case reached Pending-Authentication and then the “Update a case” shape was used to update the case status of child cases using a Data Transform, the Wait shape was being processed successfully but the child cases were not always updated as expected. This issue occurred when the cases were processed by users with different access groups, so the ProcessFlowDependencies agent processed the dependency. In this scenario, findPageByHandle returned an incorrect WorkPage because of the different access groups. To resolve this, pyLoadMyCasesNested Step-5 and pzProcessIndividualDepAssignment Step -13 now make additional checks to verify whether the page found by findPageByHandle API is a valid WorkPage or not.
SR-D90544 · Issue 550807
Corrected row focus for deleting in App Studio case model
Resolved in Pega Version 8.5
When attempting to delete a row of properties from the 2nd page of the data model of a case type while using App Studio, clicking on the delete icon brought up a dialog box asking for confirmation for deletion but at the same time the screen went back to the first page of the data model instead of remaining on the second page. Because of this, clicking on the OK button to confirm the deletion caused a random property from the first page to be deleted instead of the targeted row of the second page as expected. This was due to the refresh being triggered immediately within overlay UI actions, and has been resolved by updating the first trash icon action set for the section pzExpressFieldActions to be a modal instead of an overlay when launching local action.
SR-D72141 · Issue 542663
Approved flow rule image unlocked
Resolved in Pega Version 8.5
When the Approval Required check box was enabled for rulesets (i.e another person with access to this work queue should approve changes to the rules), a rule which was approved was unlocked and moved back to the original ruleset as expected, but the binary image associated with the flow rule remained locked and any other user other than the one who previously checked in the rule was denied access with a "check out failed" error. This locking error has been resolved by modifying the Rule-Obj-Flow!CleanUp activity to set Param.IgnoreInstanceLockedBy = true.