INC-143033 · Issue 607836
Access Control Policy documentation updated
Resolved in Pega Version 8.6
The documentation for the ACP rule (https://community.pega.com/knowledgebase/articles/security/85/creating-access-control-policy) has been updated to clarify that these rules must be checked in for the policy change to take effect. Access control policies only work when a rule is checked in. Therefore, any changes in a checked out rule will be ignored. When changing or modifying any ABAC policy rules, the rule must be checked out, updated, saved, and checked in for the changes to take effect.
INC-145944 · Issue 612847
Product Rules help updated for Report Definition filters
Resolved in Pega Version 8.6
The Product Rules help documentation has been updated to remove references to the deprecated use of When filters and List View filters as these have been replaced by Report Definition filters.
INC-158784 · Issue 625592
Throttling during email processing help documentation updated
Resolved in Pega Version 8.6
The IMAP section of the support article for throttling email has been updated to include more detailed information about the dynamic system setting used for throttling, Pega-IntegrationEngine Email_throttling_pattern_regex, and how to configure it.
SR-SR-D89339 · Issue 550312
Ping service documentation updated
Resolved in Pega Version 8.6
The documentation for ping service architecture and output has been updated to reflect that the response now includes more parameters.The response contains JSON text in the following format: {"node_type": [""],"health": [{"last_reported_time": "","test_name": "","status": ""},{"last_reported_time": "","test_name": "","status": ""}],"state": "","node_id": ""}
INC-128533 · Issue 588007
Property check handling updated for Ajax requestor
Resolved in Pega Version 8.6
SECU0001 alerts were seen when submitting a case in the interaction portal. Logging indicated the errors were related to the 'pxRequestor.pyLatitude' and 'pxRequestor.pyLongitude' properties which are included in an Ajax request when they exist in the DOM and the 'pyGeolocationTrackingIsEnabled' when rule is true. The error was traced to a condition where a new thread request results in an unexpected property check that encounters a clipboard which doesn't have any pages created for that thread. To resolve this, the 'pxRequestor.pyLatitude' and 'pxRequestor.pyLongitude' properties have been added to an allow list to handle the unexpected properties check.
INC-130703 · Issue 597254
Operator provisioning on authentication service corrected
Resolved in Pega Version 8.6
When operator provisioning was triggered on user login via authentication service, the error "ModelOperatorName is not valid. Reason: declare page parameters not supported by PropertyReference" was generated. This was traced to optimization work that had been done on the expression evaluation for operator identification, and has been resolved by adding the required GRS Syntax support in the Operator Provisioning section in SAML and OIDC.
INC-133518 · Issue 592228
Context updated for IACAuthentication activity trace
Resolved in Pega Version 8.6
After upgrade, tracing the IACAuthentication activity was not working. Investigation showed that the context object had a null tracer value, which has been resolved by updating the system so the tracer runs with the correct context.
INC-134808 · Issue 590712
Property check handling updated for Ajax requestor
Resolved in Pega Version 8.6
SECU0001 alerts were seen when submitting a case in the interaction portal. Logging indicated the errors were related to the 'pxRequestor.pyLatitude' and 'pxRequestor.pyLongitude' properties which are included in an Ajax request when they exist in the DOM and the 'pyGeolocationTrackingIsEnabled' when rule is true. The error was traced to a condition where a new thread request results in an unexpected property check that encounters a clipboard which doesn't have any pages created for that thread. To resolve this, the 'pxRequestor.pyLatitude' and 'pxRequestor.pyLongitude' properties have been added to an allow list to handle the unexpected properties check.
INC-137709 · Issue 584981
New security role added to restrict access to development-specific classes
Resolved in Pega Version 8.6
A new security role and related RAROs have been implemented to allow better security for end users on non-BAC systems. This restricts access to Rules and execution of activities on classes that are development-specific.
INC-137873 · Issue 596157
Java injection security updated
Resolved in Pega Version 8.6
Protections have been updated against a Java injection.