SR-D32991 · Issue 504130
Email Discussion Thread retains Formatting
Resolved in Pega Version 8.2.4
CSS styles were not being retained in the discussion thread when replying to InboundCorrespondence cases. This was traced to a missing value in Param.latestReply activity pzCreateExternalPostFromMail, and has been resolved by setting an initial plain text value to the param.latestReply before it is set with the HTML value. This prevents having a blank parameter value if the incoming HTML value is empty.
SR-D28060 · Issue 505637
Cross-site scripting protection added to Pega App Studio Spaces
Resolved in Pega Version 8.2.4
Ajax Request's callback success method has a mechanism to process the response object's HTML responseText, initiate and modify the changeTracker changes, and eventually call renderUI to render the DOM. However, the response object sometimes may return a different type (JSON) that may expose cross-site scripting vulnerabilities. To improve security for the Pega App Studio, the system will process the Ajax request's response text only if the response date type is not JSON by accepting a flag in the callback object passed by the caller.
SR-D26244 · Issue 504223
Label control cross-site scripting protection added
Resolved in Pega Version 8.2.4
cross-site scripting protection has been added to label control.
SR-D30215 · Issue 503682
cross-site scripting protection added to ClientDynamicData
Resolved in Pega Version 8.2.4
Cross-site scripting protection has been added to the "DesignViewIframe" & "pzHarnessID" parameters in the pzClientDynamicData HTML rule.
SR-D25972 · Issue 501482
Handling added for custom error message in post-authentication activity
Resolved in Pega Version 8.2.4
The error message in post authentication activity was always appearing as 'Login terminated because a post-authentication activity or policy failed' irrespective of the actual message being conditionally set in the activity based on post authentication logic. Investigation showed that the parameter page in the SSO post-authentication activity was not being passed to the 'pzShowAuthPolicyError' activity due to the post-authentication activity executing in authenticated context whereas the HTML fragment executed in the un-authenticated context. In order to support this use, post-authentication activity will set the error message on a predefined property and propagate that to the HTML fragment by appending the error message as a query parameter in the redirect exception URL post-authentication failure.
SR-D23862 · Issue 503896
Corrected test connection for LDAP AuthService using keystore
Resolved in Pega Version 8.2.4
When using a AuthService rule defined for LDAP using ldaps:// and a KeyStore rule that was defined to reference a local file in the server, the Test Connection button on the AuthService rule did not work and generated the following exception: "com.pega.apache.commons.httpclient.contrib.ssl.AuthSSLInitializationError: I/O error reading keystore/truststore file: null". Investigation showed that file reference keystore did not work with an LDAPS test connection because while run time used the LDAPVerifyCredentials activity, the design time validation used the activity “ValidateInfrastructure” which did not have the required code to support file reference keystore. This has been corrected.
SR-D21803 · Issue 502130
Cross-site scripting protection added for embedded portal URI
Resolved in Pega Version 8.2.4
The URI used in the top window of embedded portals has been encoded to prevent DOM based cross-site scripting.
SR-D29485 · Issue 503511
Enhancement added to modify URL encryption for load testing
Resolved in Pega Version 8.2.4
An enhancement has been added which allows conditionally modifying URL encryption for load testing. This uses the flag crypto/useportablecipherforurlencryption: if true, a portable hardcoded key is used to encrypt the URLs and if false, a dynamically generated key per thread/requestor is used to encrypt the URL.
SR-D38581 · Issue 504775
Removed unnecessary cross-site scripting filtering on paragraph rule
Resolved in Pega Version 8.2.4
When a link was set in a paragraph rule, the target option was removed in the returned layout structure. This was traced to unnecessary XSS filtering which has now been removed.
INC-202878 · Issue 713792
Handling updated for social messaging items with very large embedded images
Resolved in Pega Version 8.6.5
Job scheduler was running out of memory while handling large/multiple files, causing nodes to crash while handling Social Messaging items. Inline images were also not being sent in the ACK email. Investigation traced this to a custom job scheduler and activity used to create PDFs from email communication and send the PDFs to a third-party system. This used the standard Email Triage/PegaSocial functionality for the emails, which were stored as instances of PegaSocial-Message. The custom Job scheduler and activity then leveraged the Data Page D_pxEmailPosts to retrieve the emails in order to harvest the text from the emails. The issue occurred when a number of the emails had multiple or large embedded images in them, meaning the PegaSocial-Message instances are very large. This resulted in the node running out of memory and crashing. To resolve this, code has been added to support inline images in ACK email and the complete message from Pulse will be used instead of the original message as the email body for the ACK email.