SR-D95525 · Issue 561833
CSRF validation update
Resolved in Pega Version 8.4.2
CSRF validation has been added for non-AJAX get requests which originated from a redirected post request.
SR-D96368 · Issue 555742
10 minute cap added to lockout time interval for failed logins
Resolved in Pega Version 8.4.2
After a certain number of failed attempts, there is a process that locks out the operator for a time interval. When the interval has expired and the operator is able to try again, the next "lockout" uses a time interval double the prior size. Previously, this was able to grow without any restriction. In order to improve effective requestor management, an upper limit has been added for maximum lockout period. The default has been set at 10 minutes or 600 seconds, but this may be configured using the DSS : authPolicy/delay/maxDelay in the Ruleset: Pega-Engine. The value is set in seconds: if the value specified in the DSS is greater than 600 seconds, then the maximum lockout period will fall back to 600 seconds (10 minutes).
SR-D96395 · Issue 555119
CDK key loading modified for better database compatibility
Resolved in Pega Version 8.4.2
Users were unable to log on to the system and received the error "There has been an issue; please consult your system administrator." Investigation showed the log errors stating "(dataencryption.DataKeyProvider) ERROR localhost - Could not get CDK from systemKeyManagementCache - System CDK is null". This was an issue specific to the MS SQL Server database when there were 6 or more CDKs in the database: CDK keys are loaded from database into Cache using an SQL statement which had the ORDER clause. By default, the ORDER clause treats NULL values differently on different databases, and this caused MS SQL databases to not load a necessary CDK key. To resolve this, the SQL query has been modified so the result will be the same for all supported daatbases (Oracle, Postgres & MS SQL Server).
INC-153805 · Issue 627966
Mobile app language remains consistent after data sync
Resolved in Pega Version 8.4.5
When using a Field Service Mobile App where the locale of all workers was set to nl_NL, the UI was intermittently flipping from NL to EN and and back again. This was traced to the locale of the requestor (field worker) being lost during synchronization of the mobile app data to the server, causing the UI to fall back to the default value of EN. This has been resolved by ensuring the requestor always uses the chosen locale for the operator.
INC-155640 · Issue 622977
Mobile logging updated for data page required parameters
Resolved in Pega Version 8.4.5
After upgrade, the number of warnings increased substantially in the mobile app log file for D_Pages, specifying "Required parameter X for data page X cannot be blank." This was traced to the forced logging related to missing required parameters for Parameterized DataPages during DeltaSyncs. In order to increase the value of the logging, the process has been moved from being called before packaging the Data Page to being printed later in packaging code and set to warn only about any unsupported data page configuration with required parameters.
INC-155752 · Issue 622770
Hidden Question pages and answers will be saved to DB
Resolved in Pega Version 8.4.5
After a question page was shown and some values were entered, going back to the question and reverting an option caused the question page to not be visible, but the answer values persisted in the clipboard and were eventually saved into the database. This was a missed use case for Question page smart shapes, and has been resolved by updating the pzSetQuestionPageParams data transform so that whenever a question page is evaluated to either to show/hide, when the question page visibility is set to false and the pyClearAnswerValuesWhenQPHidden 'when' rule is overridden, the corresponding values will be wiped from the clipboard and only the required values will be saved to the database. However, please note this is not supported for branching logic and visibility conditions should be used instead.
INC-157217 · Issue 631968
Field Service mobile refresh timing updated
Resolved in Pega Version 8.4.5
A configuration in the Field Service mobile app used to select and map data from a modal section to a wrapper section used "pega.fsm.mobileutil.reloadSection" to refresh the wrapper section and make the data visible after the mapping. If the refresh was performed after the initial login, the refresh was done on only a portion of the screen and resulted in incorrect data being shown to the user. However, continuing to fill in the section and then saving and reopening the task displayed the correct results. The issue was reproducible only on the first attempt after clearing cache/date: subsequent uses refreshed properly. This was traced to the timing of the configured actions, which caused the refreshSection action to be triggered before the runDataTransform action execution was completed. This has been resolved by adding code that will pause the action queue until the runDataTransform action completed.
INC-157317 · Issue 620572
Signature Capture supported in repeating dynamic layouts
Resolved in Pega Version 8.4.5
An enhancement has been added which supports using Signature Capture on forms in repeating dynamic layouts.
INC-157532 · Issue 631714
Corrected runtime name length check for custom fields to resolve logged error
Resolved in Pega Version 8.4.5
The error "Notification_MobilePush.Action ERROR - Can't parse JSON string to map" was being frequently logged. Investigation showed that in the Step8 activity in pySendNofication from Pega-Notification-MobilePush class, setting @String.length(customFields)>0 where customFields was a local value caused the runtime length check on customFields to fail. To resolve this, the Step8 activity in pySendNofication from Pega-Notification-MobilePush class has been modified from using @String.length(customFields)>0 to use @String.length(Local.customFields)>0.
INC-157696 · Issue 623883
Able to add message to Pulse when it includes "@."
Resolved in Pega Version 8.4.5
Messages that contained the "@." character, like "@.com", "@.es" or "personas@..." were not being added in Pega Pulse. This has been resolved by setting the workid prefix in pyDefault of PegaSocial-Group and adding a check to see if the mentioned item starts with a workid prefix before doing an obj-browse.