INC-210526 · Issue 705639
Mobile supports icons for file attachment
Resolved in Pega Version 8.7.2
Attaching a file to a case in a mobile browser generated a script error popup. This has been resolved with code to support using icons to attach files on mobile.
INC-211208 · Issue 709647
Added fallback handling for missing Google Maps marker value
Resolved in Pega Version 8.7.2
The Google maps location position control was not showing the marker if the marker source was a Property. No issues were seen if a data page was used as the marker source. This was due to the pega.util. Dom.getElementsByName(markerPropertyHandle) being returned as null. Since the property value was not found in DOM, the latitude and longitude values were not resolved for the marker object. This has been resolved by relying on the markerPropertyValue as a fallback in case the property bound to the marker is not part of the DOM.
INC-214160 · Issue 709282
Access group context handling updated for Mobile
Resolved in Pega Version 8.7.2
After update, a new mobile application for a specific access group was not applying the correct access group for an operator with multiple access groups but instead used the default access group. This has been resolved by moving the logic responsible for switching access groups for Pega Mobile Client from the Authorization.getInitialAccessGroup class to the SessionAccessgroupInfo class to ensure Authorization/SessionAuthorization gets the information about the default access group for the current context.
INC-182827 · Issue 691527
URL security updated
Resolved in Pega Version 8.7.2
Security has been updated for URL tampering defense and Rule Security Mode.
INC-186897 · Issue 705203
DSS DisableAutoComplete setting honored
Resolved in Pega Version 8.7.2
Setting DisableAutoComplete DSS was not working as expected. This was traced to the system not being able to read the DSS value due to timing related to database startup, and has been resolved by directing the system to read the setting in PREnvironment.java instead of from the prconfig.
INC-198571 · Issue 708633
SSO update
Resolved in Pega Version 8.7.2
In order to ensure shared SSO direct links are used as intended, an update has been made which will explicitly require re-authentication for each use of a direct link.
INC-202702 · Issue 713724
Ruleset creation process updated to maintain thread scope
Resolved in Pega Version 8.7.2
On creating a ruleset, the system generated the error "There has been an issue. Please consult your system administrator." If browser cookies and site settings were cleared and the browser was relaunched before logging in and creating a ruleset, the issue did not occur. Investigation showed that the Application page was at the Requestor scope for some of the threads due to handling in the ruleset creation process that removed the Application page and recreated it in the default scope of the thread with the latest state. To resolve this, the process for deleting the Application page and recreating it on the Requestor page has been removed.
INC-211426 · Issue 706060
UI and code changes to support Client Assertion in Open ID Connect
Resolved in Pega Version 8.7.2
In order to support private_key_jwt, an enhancement has been added which will pass the “Client ID” and “Client assertion” (in the form of a signed JWT) as part of the authorization code grant flow for an IDP-initiated SSO. The Authorization Server will then authenticate Pega (the client) to verify the signature and payload of assertion by retrieving the public key via Pega’s JWKS endpoint.
INC-212265 · Issue 714013
at+jwt header type support added
Resolved in Pega Version 8.7.2
After upgrading from Pega 7 to Pega 8, using JWT validation in the REST service package with type "at+jwt" resulted in the JSON web token being rejected during signature verification with the error "header "typ" (type) "at+jwt" not allowed". Pega uses the third-party Nimbus jar to generate and verify JWT tokens, and this issue was traced to a difference in the versions of that jar: Pega 7.3 uses the nimbus-jose-jwt 5.1 version jar, while Pega 8.6+ uses the 8.20 jar version. Nimbus rejects at+jwt header types by default from the 8.0 jar version. To resolve this and improve backwards compatibility, at+jwt header type support has been added.
INC-215343 · Issue 711087
Security updates
Resolved in Pega Version 8.7.2
Security updates have been made relating to rulesets using allow lists, checks for Java code injections, SAML-based SSO code, and supporting SFTP as part of the validation in the pxValidateURL rule.