INC-163914 · Issue 668845
Improved Agile Studio passivation recovery
Resolved in Pega Version 8.6.2
When an Agile Studio session was passivated, the error "SECU0008 : CSRF Detected and Blocked" was seen. Reactivating the session resulted in a blank page. This was traced to the clearing of requestor level registrations added for that particular thread, and has been resolved by adding a new flag to identify if a thread is passivated along with the necessary structure for the conditionalized clearing of requestor level registrations based on this flag.
INC-179360 · Issue 662177
Check added for allowed editing with CSRF
Resolved in Pega Version 8.6.2
After enabling CSRF, it was not possible to edit a data table used to define ACL rules due to security preventing the adding/editing of rows and user group entitlements. This has been resolved by using browser FingerPrint validation to check whether an activity is in a secured list and skipping validation for allowed activities.
INC-180275 · Issue 666455
Collaboration control hidden if data type is delegated
Resolved in Pega Version 8.6.2
When collaborating using a customized CaseManager portal with some delegated data types, the admin user refreshing the Data Type view changed the collaborator's view from the portal to show the Data Type tabs, allowing the second person to open rules (properties, Data Pages, etc) and see the configuration even though they could not make any changes. This has been resolved by updating pzDataTypeDelegated to display the collaboration control only if pzDelegation is false.
INC-180594 · Issue 670955
Filtering added for DisableDormantOperators
Resolved in Pega Version 8.6.2
When running the Disable Dormant Operators agent, many operators were seen which were dormant but not disabled. Investigation showed the activity was fetching all of the operators without filtering the deactivation state. This has been resolved by adding a filter condition in pzDisableDormantOperators to fetch only deactivate state users.
INC-184804 · Issue 669638
Password security enhanced
Resolved in Pega Version 8.6.2
Security and authentication have been enhanced for password handling.
INC-185362 · Issue 668825
Keystore update properly revises the cache
Resolved in Pega Version 8.6.2
A keystore updated with the latest certificate was not getting reflected in the runtime and the old certificate was getting picked. In a multi-node environment when the new JKS is uploaded in one node, the changes are expected to be communicated to other nodes so that the cache can be cleaned up. In this case, investigation showed that the keystore label was in uppercase and the cache entry was not correctly removed. This has been resolved by adding an update that will convert the cache key to lowercase and maintain uniformity to ensure proper cleanup.
INC-186512 · Issue 669327
Password security enhanced
Resolved in Pega Version 8.6.2
Security and authentication have been enhanced for password handling.
INC-168253 · Issue 652546
Documentation updated for using Connect MQ with clustered queues
Resolved in Pega Version 8.6.3
After update to Pega Platform v8.6, an issue was seen with Connect MQ rules that used an alias queue. The support documentation has been revised to outline the necessary steps for updating an application to perform as expected. In the Pega-IntegrationEngine ruleset, create the following dynamic system settings and their default values: "mq/pmo" = 0 "mq/gmo" = 0 "mq/oo_request" = 1040 "mq/oo_response" = 16 For more information, dynamic system setting support articles are available.
INC-170458 · Issue 677862
Handling updated for queue processor locks
Resolved in Pega Version 8.6.3
The Final activity mentioned in the processing epilog of the Service File rule was not being consistently called from File Listener, causing some of the cases to become stuck and not continue to the next stage. Investigation showed that if the lock was held by the queue processor requestor, the system was unable to obtain the lock but still proceeded to update the LogServiceFile page and persist it. This resulted in overwriting changes made on the LogServiceFile page by the requestor, resetting the completed-batches-count set back to 0. To resolve this, RuleServiceFile -> updateLSFBatchCounts() will call the overloaded lockAndLoad() method in LogServiceFile that accepts a parameter called lockAttempts. This will attempt to obtain a lock for a given number of times before throwing an exception.
INC-173434 · Issue 672675
Pushservlet cookie path updated to resolve error
Resolved in Pega Version 8.6.3
A very large number of exceptions were being logged indicating "Unhandled error in web.request.internal.URLComponentProcessorImpl.populateCSRFToken", impacting the ability to perform log analysis. This exception has been resolved by updating the pushservlet cookie path.