SR-B37957 · Issue 278510
XSS security added for date property error message
Resolved in Pega Version 7.3
A cross site scripting filter has been added for pyErrorMessage in order to improve security.
SR-B38317 · Issue 295056
Password expiry logic updated to use start of day
Resolved in Pega Version 7.3
Previously, the password expiry logic was based on a tight format of number of days+ timeStamp. This caused scenarios such as not prompting for a password reset when user logs in, but rather at the exact time stamp of the previous change even if that comes in the middle of work and throws the user out of the session. To avoid this behavior, the password expiry logic is now based on number of days logic with timeStamp defaulted to start of day (00.00) taking care of locale and getting difference in number of days.
SR-B38602 · Issue 296751
Login error message modified for increased security
Resolved in Pega Version 7.3
When an operator was configured to use External authentication and then attempted to login through other servlets, the error message included the operator ID. This could be used maliciously to discover valid IDs on the system, so in order to improve security, the process has been modified to remove the ID from the failure message. If authentication fails, the message "The information you entered was not recognized." will be displayed and the system will log an error message in the PegaRULES log file with the actual message "Error authenticating , : This user must use external authentication."
SR-B38602 · Issue 297290
Login error message modified for increased security
Resolved in Pega Version 7.3
When an operator was configured to use External authentication and then attempted to login through other servlets, the error message included the operator ID. This could be used maliciously to discover valid IDs on the system, so in order to improve security, the process has been modified to remove the ID from the failure message. If authentication fails, the message "The information you entered was not recognized." will be displayed and the system will log an error message in the PegaRULES log file with the actual message "Error authenticating , : This user must use external authentication."
SR-B38647 · Issue 297399
ServiceExport folder access restricted for guest users
Resolved in Pega Version 7.3
In order to increase data security, access to the 'ServiceExport' folder has been blocked for Guest users (Un-Authenticated users who have pre-atn cookie) on single-tenant sites. Once the user is logged in with valid credentials, the folder contents will be available. For backward compatibility the PRConfig setting 'serviceexportcontent/allowtoguestusers' has been added; if set to true then guest users will have access. The default is false.
SR-B38958 · Issue 296022
Updates to field values reflected on mobile
Resolved in Pega Version 7.3
After updating field values in higher ruleset versions and forcing a full data sync, the mobile app did not reflect the updated value. This was due to rule resolution not happening while packaging the FieldValue rules due to locale, and has been corrected by changing the PZGETFIELDVALUES rule to sort the pzInsName based on the ruleset versions and picking the latest available rules from the ruleset.
SR-B39293 · Issue 296727
Mobile checkbox controls fire validations
Resolved in Pega Version 7.3
Validations were not fired on checkbox controls on a mobile application; the same scenario worked fine when tested on the desktop. This was due to a missing Validation Attributes property, and has been fixed.
SR-B39293 · Issue 297091
Mobile checkbox controls fire validations
Resolved in Pega Version 7.3
Validations were not fired on checkbox controls on a mobile application; the same scenario worked fine when tested on the desktop. This was due to a missing Validation Attributes property, and has been fixed.
SR-B39293 · Issue 299867
Mobile checkbox controls fire validations
Resolved in Pega Version 7.3
Validations were not fired on checkbox controls on a mobile application; the same scenario worked fine when tested on the desktop. This was due to a missing Validation Attributes property, and has been fixed.
SR-B39489 · Issue 290738
KeyStoreType of PKCS12 passes validation
Resolved in Pega Version 7.3
Keystore has an allowed file type of PKCS12, but an invalid type error was generated when trying to create a keystore file of this type. This has been corrected.