SR-C8023 · Issue 350229
Updated dataflow used after pause/continue
Resolved in Pega Version 7.4
When using an event dataflow that has a Kafka dataset as the source, running the flow, pausing it, and importing updated rules was resulting in the resumed flow still using the old rules. This was a known limitation in the data flow metrics management where when a run was resumed, the previous metrics were "merged" with new metrics. In cases where the structure of a data flow changed between pause/resume, merge failed silently and new metrics were not saved to the database. The metric management has now been updated to merge metrics correctly: in case of a data flow structure update (e.g. shapes added/removed), after the data flow is run, stage metrics will be cleared up as it is not possible to match them with the new structure, and all other metrics will be properly resumed from the "paused" position (e.g. number of processed records, throughput etc.).
SR-B45056 · Issue 328736
XSS filtering added to getClassOfPageReference
Resolved in Pega Version 7.4
XSS filtering has been added to the URL produced when using getClassOfPageReference.
SR-B45056 · Issue 330368
XSS filtering added to getClassOfPageReference
Resolved in Pega Version 7.4
XSS filtering has been added to the URL produced when using getClassOfPageReference.
SR-B74553 · Issue 326255
Refined accessgrouplist checks
Resolved in Pega Version 7.4
Following a system modification that changed the property used to populate the access groups list to match that on clipboard (correct value), a previously unseen issue was uncovered where all the division and organization AGs were being added to the list. This has been addressed by updating the code to add the applications on division and organization only when there is no default selected at the operator. If there is some application selected as default at the operator, then the division or organization applications will not be added. If there is nothing selected at operator, then a check for division will be made, and if there is nothing selected at division then organization will be checked.
SR-B78496 · Issue 327358
Refined accessgrouplist checks
Resolved in Pega Version 7.4
Following a system modification that changed the property used to populate the accessgroups list to match that on clipboard (correct value), a previously unseen issue was uncovered where all the division and organization AGs were being added to the list. This has been addressed by updating the code to add the applications on division and organization only when there is no default selected at the operator. If there is some application selected as default at the operator, then the division or organization applications will not be added. If there is nothing selected at operator, then a check for division will be made, and if there is nothing selected at division then organization will be checked.
SR-B81365 · Issue 332518
Enhanced security for IAC gadget
Resolved in Pega Version 7.4
The code for the IAC gadget has been reworked to replace eval functions in order to enhance security.
SR-B81365 · Issue 331996
Enhanced security for IAC gadget
Resolved in Pega Version 7.4
The code for the IAC gadget has been reworked to replace eval functions in order to enhance security.
SR-B82500 · Issue 331560
Enhancement to support external delegated authentication via custom authentication
Resolved in Pega Version 7.4
OAuth 2.0 configuration has been embedded into the HC mobile app to provide an infrastructure for REST services to be authenticated by an external token which has been issued by third party identity provider. When Pega receives a token, it then contacts the identity provider's token introspection and userinfo endpoint to validate the token and subsequently establish an identity. The new authentication activity has been shipped with the name 'pyPerformDelegatedAuthentication' that can be attached to any Authentication service data instance.
SR-B82500 · Issue 332132
Enhancement to support external delegated authentication via custom authentication
Resolved in Pega Version 7.4
OAuth 2.0 configuration has been embedded into the HC mobile app to provide an infrastructure for REST services to be authenticated by an external token which has been issued by third party identity provider. When Pega receives a token, it then contacts the identity provider's token introspection and userinfo endpoint to validate the token and subsequently establish an identity. The new authentication activity has been shipped with the name 'pyPerformDelegatedAuthentication' that can be attached to any Authentication service data instance.
SR-B83952 · Issue 338450
Handling added for URL encoding problem
Resolved in Pega Version 7.4
A button configured with 'onClick > Open URL in window' had the "?" replaced by "?=%26" in the URL. This was traced to a safeURL bug which encodes '&' in the URL when there is no key=value pair in the request params. To compensate for this, a design time configuration has been added to skip encoding if the system encounters custom URLs with no key=value pairs.