INC-183650 · Issue 678312
Corrected doubled tag removal
Resolved in Pega Version 8.6.4
After adding two tags for a Service case, attempting to delete the first tag resulted in the second tag also being removed. When three tags were present in the case, deleting the first tag caused the first and second to be deleted. Investigation showed this was caused by the run activity pyRemoveTagLink being called twice in run time, and has been resolved by updating the run activity.
INC-164432 · Issue 696294
Global obfuscation key initialized on first requestor call
Resolved in Pega Version 8.6.4
When using URLEncryption = true and SubmitObfuscatedURL = optional, attempting to export an Excel spreadsheet resulted in the error "Invalid character found in the request target". This was traced to the variable pega.d.globalobfuscateKey having a null value which was then converted to a byte array and decoded, generating improper characters in the URL. After a browser refresh, the correct value was set in pega.d.globalobfuscateKey and the export worked as expected. To resolve this, an update has been made to initialize the key on the very first call in PRRequestorImpl when the global obfuscation key is determined to be NULL instead of initializing the global obfuscation key by on-demand basis from HTTPAPI.
INC-182827 · Issue 691528
URL security updated
Resolved in Pega Version 8.6.4
Security has been updated for URL tampering defense and Rule Security Mode.
INC-209298 · Issue 704141
Added security tokens to Worklist assignment error wizard
Resolved in Pega Version 8.6.4
After enabling CSRF, moving to 'Configure -> Case Management -> Tools -> Work Admin -> Worklist assignment errors' and then selecting a record and clicking on 'Delete' resulted in a '403 Forbidden' error. This has been resolved by adding CSRF and fingerprint tokens as part of the form data.
INC-211426 · Issue 706061
UI and code changes to support Client Assertion in Open ID Connect
Resolved in Pega Version 8.6.4
In order to support private_key_jwt, an enhancement has been added which will pass the “Client ID” and “Client assertion” (in the form of a signed JWT) as part of the authorization code grant flow for an IDP-initiated SSO. The Authorization Server will then authenticate Pega (the client) to verify the signature and payload of assertion by retrieving the public key via Pega’s JWKS endpoint.
INC-215343 · Issue 711141
Security updates
Resolved in Pega Version 8.6.4
Security updates have been made relating to rulesets using allow lists, checks for Java code injections, SAML-based SSO code, and supporting SFTP as part of the validation in the pxValidateURL rule.
SR-D87898 · Issue 552589
SaveAttachment Activity in Data-WorkAttach-URL updated
Resolved in Pega Version 8.5
A 'when' condition was not properly evaluated for Activity SaveAttachment (CL:Data-WorkAttach-URL ), causing the Next assignment screen to not be displayed. This has been resolved by modifying the handling of Page Names used as activity parameters to remove the use of the specific PageName "pyAttachmentPage" in the operation and make it generic to Primary in the SaveAttachment Activity of CL: Data-WorkAttach-URL.
SR-D64506 · Issue 529334
Improved accessibility around page landmarks
Resolved in Pega Version 8.5
Accessibility testing revealed an issue with pages where the main landmark was contained in another landmark. This has been resolved by removing the main role in the FlowActionHTML rule.
SR-D84480 · Issue 546188
FilterHistory decision tree used for audit log status
Resolved in Pega Version 8.5
Attempting to use the “FilterHistory” decision tree in the work class to return value “false” for “pyCloseOpenAssignmentsOnResolution” to hide the “pyCloseOpenAssignmentsOnResolution” field value (“Unfinished assignments were cleaned up by the system after the completion.. ”) from history was not working as expected, and still returned the audit message. This was due to the system setting this AuditNote parameter within the “pzProcessResolutionStage” activity, where Param.UpdateHistory was set to true always. In order to support more flexibility, the Param.updateHistory paramter in step3 of the pzProcessResolutionStage activity will be set based on the FilterHistory decision tree. When set to false in FilterHistory decision tree, pyCloseOpenAssignmentsOnResolution will be set as false and audit will not be logged.
SR-D84754 · Issue 548164
Resolved erroneous problem assignment error
Resolved in Pega Version 8.5
If a user processed a work item while the SLA agent was also attempting to process it, it sometimes resulted in an assignment with the error: "Error: Flow Not At Task." In this scenario, an error message was displayed stating that "Assignment already completed" even though the assignment was not yet finished, causing confusion. Investigation showed that in cases where the success indicator was -28, the assignment was marked as problem assignment even though it was processed. To resolve this, the system has been updated to skip marking the assignment as a problem when the success indicator is -28.