INC-207996 · Issue 709663
Check added for parent case dependency if deferred-save is used
Resolved in Pega Version 8.6.4
After updating the status of a parent case to "Pending-ChildCaseDependency", the wait shape for the child case that should have been triggered by the status did not work and the child case remained on hold. This was a missed use case for the pxCheckFlowDependencies activity where defer-save operations on Index-AssignDeps class was not considered, and may happen when the Queue Processor is evaluating the dependencies while instances to Index-AssignDeps are not committed yet. To resolve this, code has been added to check the entry of the parent case dependency in deferred-save if its not present in Index-AssignmentDeps table.
INC-210680 · Issue 712072
Updated logic for setting param.PrimaryPage in transfer
Resolved in Pega Version 8.6.4
TransferAssignment was failing intermittently when doing routing either by background processing or manual transfer. Investigation showed this was caused by a null param.PrimaryPage value which resulted in a NullStepPage exception. This has been resolved by adding a Property-Set method just before calling the activity pxTransferAssignment. In addition, the "Require authentication to run" check box in the pxTransferAssignment activity has been set to on.
INC-212896 · Issue 711188
Resume Flow will print Flow Action Label in audit history
Resolved in Pega Version 8.6.4
After calling Resume Flow for processing the assignments, when the Assignment was processed the Flow Action Name was printed on the Audit History instead of Flow Action Label. Investigation showed that in the Complete assignment activity, there was no code in the 'if' loop to set the value of actionLabel. If the value was null, the property set in the next step sets actionLabel to flowActionID and the audit history result is FlowAction ID instead of FlowAction Label. To resolve this, logic has been added in the CompleteAssignment Activity step 5 to set ActionLabel with Flow Action Label.
INC-183650 · Issue 678312
Corrected doubled tag removal
Resolved in Pega Version 8.6.4
After adding two tags for a Service case, attempting to delete the first tag resulted in the second tag also being removed. When three tags were present in the case, deleting the first tag caused the first and second to be deleted. Investigation showed this was caused by the run activity pyRemoveTagLink being called twice in run time, and has been resolved by updating the run activity.
INC-164432 · Issue 696294
Global obfuscation key initialized on first requestor call
Resolved in Pega Version 8.6.4
When using URLEncryption = true and SubmitObfuscatedURL = optional, attempting to export an Excel spreadsheet resulted in the error "Invalid character found in the request target". This was traced to the variable pega.d.globalobfuscateKey having a null value which was then converted to a byte array and decoded, generating improper characters in the URL. After a browser refresh, the correct value was set in pega.d.globalobfuscateKey and the export worked as expected. To resolve this, an update has been made to initialize the key on the very first call in PRRequestorImpl when the global obfuscation key is determined to be NULL instead of initializing the global obfuscation key by on-demand basis from HTTPAPI.
INC-182827 · Issue 691528
URL security updated
Resolved in Pega Version 8.6.4
Security has been updated for URL tampering defense and Rule Security Mode.
INC-209298 · Issue 704141
Added security tokens to Worklist assignment error wizard
Resolved in Pega Version 8.6.4
After enabling CSRF, moving to 'Configure -> Case Management -> Tools -> Work Admin -> Worklist assignment errors' and then selecting a record and clicking on 'Delete' resulted in a '403 Forbidden' error. This has been resolved by adding CSRF and fingerprint tokens as part of the form data.
INC-211426 · Issue 706061
UI and code changes to support Client Assertion in Open ID Connect
Resolved in Pega Version 8.6.4
In order to support private_key_jwt, an enhancement has been added which will pass the “Client ID” and “Client assertion” (in the form of a signed JWT) as part of the authorization code grant flow for an IDP-initiated SSO. The Authorization Server will then authenticate Pega (the client) to verify the signature and payload of assertion by retrieving the public key via Pega’s JWKS endpoint.
INC-215343 · Issue 711141
Security updates
Resolved in Pega Version 8.6.4
Security updates have been made relating to rulesets using allow lists, checks for Java code injections, SAML-based SSO code, and supporting SFTP as part of the validation in the pxValidateURL rule.