SR-A24598 · Issue 247394
Apache Struts updated for security
Resolved in Pega Version 7.2.1
Apache Struts has been updated to version 2.3.28 to protect against potential security vulnerabilities exposed when Dynamic Method Invocation is enabled, removing the ability for remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
SR-A4613 · Issue 227870
Updated logging for "Obfuscated URL tampering" errors
Resolved in Pega Version 7.2.1
The error "pegarules.util.URLObfuscation) ERROR - Obfuscated URL tampering - unable to derive cleartext data" was being logged when the "cookie/HttpOnly" parameter was set. This was traced to the unobfuscating of data failing at the server end, and the loggers have been updated to print requestor data for better diagnostics.
SR-A4719 · Issue 230767
Fixed improper ID carryover after reset all loggers
Resolved in Pega Version 7.2.1
When a user reset the logs, the same user ID was then being populated in the log entries of master agent and requestor lock exceptions from that point on even when the exceptions were from other users. This was due to the username not being cleared correctly after the reset all loggers operation is done, and to fix this, the reset all loggers functionality has been changed such that no data from main thread is copied onto the child thread(the dispatcher thread).
SR-A8475 · Issue 233560
Fixed Multiselect grid drag and drop
Resolved in Pega Version 7.2.1
When using MultiSelectList Control, if a value was selected and then 'submit' was used to populate the Grid's data, dragging and dropping the Grid's row to some other workbasket did not work. This happened because the clipboard calls the remove property with a symbolic delete when doing a drag and drop. While processing this delete, if the mode of property was unknown the system was unable to look up the property definition in the dictionary, and an exception occurred. To fix this, handling has been added to lookup the definition of the property if it is unknown before removing it.
INC-125803 · Issue 568661
Cross-site scripting updated on activities
Resolved in Pega Version 8.1.9
Additional Cross-site scripting work has been done on activities.
INC-127981 · Issue 563000
Rulesets removed from direct invocation ability
Resolved in Pega Version 8.1.9
Internal rules have been updated so that they are no longer available to be invoked directly by a client or service.
INC-146837 · Issue 602673
PerformCriteria contains CurUserHasRequiredSkills 'when' rule
Resolved in Pega Version 8.1.9
A customer version of the PerformCriteria data transform was generating a validation error due to a qualified statement that resulted in a null result. This has been resolved by updating the PerformCriteria DT to include the CurUserHasRequiredSkills 'when' rule.
SR-D65866 · Issue 536427
Corrected approval step task message
Resolved in Pega Version 8.1.9
When a case progressed to the approval step, the task name did not properly appear as part of the "Please approve or reject this" message. In another scenario, a portal which supported locale switching was not translating "Please approve or reject this" when the locale was switched, but instead displayed the message in the original language. Investigation traced this to the pzInstructionsForApproval data transform storing the localized field value, causing it to persist inappropriately. This has been resolved.
INC-174435 · Issue 659479
Survey Complex Question Definition properly displayed
Resolved in Pega Version 8.4.6
Selecting any Complex Question to look at the definition displayed a blank screen. This was traced to an issue with the ruleformtabs properties for the layout group used by complex questions, and has been resolved by changing the Layout Group display type from "Default" to "Tab".
INC-175533 · Issue 678911
Improved Page compare for page groups
Resolved in Pega Version 8.4.6
Field level auditing on embedded properties sporadically did not report the "old" value when a property was modified even though the page was listed as "Modified". This has been resolved by adding logic to the pxComparePages algorithm to treat Lists and Groups differently. Now Page and Value Groups will use pxSubscript as the primary way to detect add and deletes.