SR-D95501 · Issue 557684
Updated jar supporting SAML login to work with JRE11
Resolved in Pega Version 8.4.2
SO authentication was failing with the exception "Caused by: java.lang.NoClassDefFoundError: Could not initialize class org.apache.commons.ssl.TrustMaterial". That class was packaged with Pega via the not-yet-commons-ssl.jar which is no longer being developed and only works with JRE8. This has been resolved by updating the package to the new not-going-to-be-commons-ssl.jar which has been evaluated for all supported JRE versions.
SR-D95525 · Issue 561833
CSRF validation update
Resolved in Pega Version 8.4.2
CSRF validation has been added for non-AJAX get requests which originated from a redirected post request.
SR-D96368 · Issue 555742
10 minute cap added to lockout time interval for failed logins
Resolved in Pega Version 8.4.2
After a certain number of failed attempts, there is a process that locks out the operator for a time interval. When the interval has expired and the operator is able to try again, the next "lockout" uses a time interval double the prior size. Previously, this was able to grow without any restriction. In order to improve effective requestor management, an upper limit has been added for maximum lockout period. The default has been set at 10 minutes or 600 seconds, but this may be configured using the DSS : authPolicy/delay/maxDelay in the Ruleset: Pega-Engine. The value is set in seconds: if the value specified in the DSS is greater than 600 seconds, then the maximum lockout period will fall back to 600 seconds (10 minutes).
SR-D96395 · Issue 555119
CDK key loading modified for better database compatibility
Resolved in Pega Version 8.4.2
Users were unable to log on to the system and received the error "There has been an issue; please consult your system administrator." Investigation showed the log errors stating "(dataencryption.DataKeyProvider) ERROR localhost - Could not get CDK from systemKeyManagementCache - System CDK is null". This was an issue specific to the MS SQL Server database when there were 6 or more CDKs in the database: CDK keys are loaded from database into Cache using an SQL statement which had the ORDER clause. By default, the ORDER clause treats NULL values differently on different databases, and this caused MS SQL databases to not load a necessary CDK key. To resolve this, the SQL query has been modified so the result will be the same for all supported daatbases (Oracle, Postgres & MS SQL Server).
INC-166995 · Issue 642440
DeleteDocumentPg added to allow list
Resolved in Pega Version 8.7
During performance testing with CSRF settings enabled, a '403 Forbidden' error was seen in the network trace when FinishAssignment called pyActivity=pyDeleteDocument on close action. This has been resolved by adding pyDeleteDocumentPg to the list of allowed activities.
INC-161463 · Issue 638003
Case Dependency corrected for different access groups
Resolved in Pega Version 8.7
Creating a queue item as part of the case dependency was not working as expected when the access groups of the dependent cases were different. Investigation showed that in this scenario, the logic was looping differently and the DependencyList page in pxCheckFlowDependencies was getting removed. To resolve this, the DependencyList page has been moved so it is processed inside the DependencyList.pxResults loop.
INC-161948 · Issue 638963
Locking settings enabled for circumstanced case types
Resolved in Pega Version 8.7
Optimistic locking options were not present for a circumstanced case type, and the option to select the "Lock parent case when an action is performed on this case" check box was not available. However, when the parent case type was enabled with optimistic locking, a circumstanced child case could inherit a lock from its parent. Because "Lock parent case when an action is performed on this case" was not enabled on the circumstanced child case type, trying to update the parent case from the child case and save the parent case resulted in a "Lock not held on parent" error. This was a missed use case, and has been resolved by enabling locking settings in Case Designer for circumstanced case types.
INC-162168 · Issue 644731
Refresh works for nested lists
Resolved in Pega Version 8.7
After creating Pagelist A with another Pagelist within (B), a section was created with a repeating dynamic layout to display Pagelist A and a button was added with action set to refresh this section. In the embedded section of the repeating dynamic layout, a nested repeating dynamic layout was created for Pagelist B and a button was set to refresh this section. When using this configuration, the refresh was returning the actionID for Pagelist A regardless of which button was used. To resolve this, an update has been made which will iterate over the stack and append the individual indexes to the encoded value in the pzAPICreateJsonForField function.
INC-162763 · Issue 646109
Case creation and Save As performance improvements
Resolved in Pega Version 8.7
Performance improvements have been made to the getApplicationRuleSetList() function to avoid unnecessary and repetitive database calls.
INC-163154 · Issue 638100
Code updated for bulk actions buttons
Resolved in Pega Version 8.7
After upgrade, hovering over the "Filter case" button in pzBullkUpdate and the "Create" and "Clear" buttons in pzBulkAddActions caused them to disappear. The warning "This button generates markup that was used to support the older browsers. It is recommended that you update it to the newer markup" was shown, and an update code button appeared. Some custom rules exhibited the same behavior initially, but worked as expected after updating the code and saving them. This has been resolved by updating the buttons in pzBulkUpdate and pzAddBulkActions with the latest UI technologies used for button control codes.