INC-161660 · Issue 633032
Authorization token handling and cleanup improved
Resolved in Pega Version 8.6
When using a mobile app configured with default authentication, clicking on the "Trouble logging in?" link opened a new window and displayed the message "please contact your system administrator" along with the error "Only authenticated client may start this activity: RULE-OBJ-ACTIVITY CODE-SECURITY PZGETAUTHORIZATIONCODE". This has been resolved. In addition, the OAuth token generation and handling has been improved, and the purge agent has been updated to accept a DSS setting for the max number of expired records to purge each time it is run. The default value is 5000.
SR-SR-D79737 · Issue 602304
Improvements for Report Definition OperatorID filtering
Resolved in Pega Version 8.6
Report Definition filters were not working as expected when data from the OperatorID page was used and authentication was enabled. This was traced to the OperatorID page not being correctly populated. To resolve this, the authentication logic has been modified to always create the OperatorID page at requestor level, and the HTTP API layer has been updated to remove the thread level OperatorID page if exists. In addition, an enhancement has been added for improved debugging on log appenders provided by log4j which allows log filtering based on the requestor and thread for a given appender at a specific log level.
SR-D49537 · Issue 521112
Embedded Pega Chat error resolved
Resolved in Pega Version 8.2.6
A cross-origin frame error was shown when the Pega Chat Window was embedded in a non-Pega page. Investigation traced the issue to code that was accessing the top/parent window, and which failed when used in a mashup scenario. This has been resolved with a try/catch block to wrap the code and handle scenarios where the
SR-D49782 · Issue 518048
Extension point added for ClearInteraction to support custom interactions
Resolved in Pega Version 8.2.6
In order to support clearing a custom interaction page after clicking the "Reset" button on preview console, an extension point has been added to pyClearInteraction.
SR-D57865 · Issue 520963
Added property check for outbound templated email reply
Resolved in Pega Version 8.2.6
When a template was used for the first time for outbound correspondence, email was generated correctly. If the same template was used as the content for reply, the generated email skipped all styles. This was traced to a missing property check, and has been resolved.
SR-D63638 · Issue 544016
Performance improvements for opening cases with embedded images
Resolved in Pega Version 8.2.6
Opening cases containing email interactions was taking an excessive amount of time. This was traced to the use of embedded images, icons, etc, in the message body and signature, and was caused by the pyGetAttachmentsbyCID activity running multiple times due to discussion threads that were duplicated over and over. In some cases, more than 360 calls to the database were seen. This has been resolved by shifting some case opening processes to executing when the listener thread gets the mail, and storing the results in a .pynote property, and a URL will be used to get images instead of embedding them directly to the HTML. If preferred, this can be reverted to the previous behavior by changing the when rule (pyUseCachedHtmlForDisplay) to false.
SR-D31734 · Issue 515656
Cross-site scripting protection added for parameter page properties
Resolved in Pega Version 8.2.6
An Cross-site scripting vulnerability was seen with the Edge browser when run on visibility on client check was enabled with dynamic layouts and some properties were accessed from parameter page. Because run on visibility on client check is not required in this scenario, is has been removed and the values will be accessed from the server instead.