INC-134808 · Issue 590713
Property check handling updated for Ajax requestor
Resolved in Pega Version 8.3.5
SECU0001 alerts were seen when submitting a case in the interaction portal. Logging indicated the errors were related to the 'pxRequestor.pyLatitude' and 'pxRequestor.pyLongitude' properties which are included in an Ajax request when they exist in the DOM and the 'pyGeolocationTrackingIsEnabled' when rule is true. The error was traced to a condition where a new thread request results in an unexpected property check that encounters a clipboard which doesn't have any pages created for that thread. To resolve this, the 'pxRequestor.pyLatitude' and 'pxRequestor.pyLongitude' properties have been added to an allow list to handle the unexpected properties check.
INC-140101 · Issue 597636
System will attempt to decrypt data ending in "+"
Resolved in Pega Version 8.3.5
Encrypting and decrypting one specific email address was not working properly when showing on the UI. It was possible to force a decryption using decryptproperty, but Pega generated an error. This was due to the actual encrypted value ending with '+', which conflicted with a system check that skips decryption if the encrypted property value ends with + . To resolve this, the system will attempt to decrypt the property even when encryptedText ends with + .
INC-137874 · Issue 599130
Cross-site scripting update for Dev Studio
Resolved in Pega Version 8.3.5
Cross Site Scripting (Cross-site scripting) protections have been added to Developer Studio.
INC-139705 · Issue 595169
Documentation update for Security Settings for DX API
Resolved in Pega Version 8.3.5
Information on the pyDXAPIEncodeValues application setting has been added to the Security Settings for DX API article under the Application settings sub-section. The Pega Platform version that supports the pyDXAPIEncodeValues application setting is mentioned in the Supported UI capabilities article.
SR-D28060 · Issue 498749
Cross-site scripting filtering added to App Studio
Resolved in Pega Version 8.3.1
The pzDisplaySpaceFeedTitle control which is used to display the audit feed in Pega App Studio has been updated with cross-site scripting filtering.
SR-D28293 · Issue 498233
Pega Survey answer values support special characters
Resolved in Pega Version 8.3.1
When using a Complex radio control (RadioButtonComplexQuestionSurvey), a selected option that used answer values containing special characters was cleared on refresh. This was traced to a mismatch between strAnswer and strValue in the control logic, and has been corrected.
SR-D30428 · Issue 503424
Added handling for deprecated UI Kit in Pulse OpenURLInWindow
Resolved in Pega Version 8.3.1
After upgrade, clicking on a link in a Pulse comment opened a new window with an error message indicating no content was returned. Investigation showed that if an older deprecated version of the UI kit was used, 'Open URL in window' was configured as Run Script function. The more recent versions use an OpenURLInWindow action. To resolve this, the script has been updated to use an action and pass the correct parameters.
SR-D33052 · Issue 502061
Blank space removed in email reply
Resolved in Pega Version 8.3.1
An issue with blank space being added between the CSR icon and the email content for the first customer mail has been resolved by setting the window width to 100%.
SR-D33930 · Issue 507970
Check added to pyWorkPage before context page replacement
Resolved in Pega Version 8.3.1
When given an assignment configured with Save and Next buttons where the on-click of the Next button triggered FinishAssignment and the case type used Optimistic locking, the workobject lock was not acquired and an error was thrown when clicking Save and then the Next button. Investigation showed that the lock was not acquired because the pyCaseUpdateInfo page was not available in the work object under pyWorkPage. This was traced to the 'When' condition used to display the delete icon on a pulse post. This When condition needs to be evaluated on the context page (in this case, the work page), but when multiple posts are present on the WorkObject) the pyWorkPage was being replaced with a fresh copy from the DB and any updates on the current work page were lost. To resolve this, the behavior has been changed from always creating a context page to only creating the context page if one does not already exist on the Thread.
SR-D7323 · Issue 493176
Pin Case to Board updated to use unique IDs for different workpools
Resolved in Pega Version 8.3.1
When using the Pin Case to Board functionality, it was only possible to find and pin cases in the default/current work pool of the working access group and not any other cases in any other work pools which allowed access to open/search/process. This was due to pyLabel being used to compare if a value entered was valid, which was not a unique key. To resolve this, the pyValidatePinDetails activity in Pega-Ext-Mentions-Documents, Pega-Ext-Mentions-Cases, and Pega-Ext-Mentions-Groups classes have been updated to compare pzInsKey instead of pyLabel to check for validate pin.