SR-B95798 · Issue 344526
XSS filtering added to GetTour
Resolved in Pega Version 7.4
Cross scripting filtering has been added to pxGetTour java step 7, which prepares JSON.
SR-C1107 · Issue 351146
Oauth tokens obtained on login timeout
Resolved in Pega Version 7.4
When the client idle time expires, the user must perform a login in order to get back into the application. If OAuth is being used for authentication there is no need to re-send the credentials to NetIQ if neither the refresh token nor access token are expired yet, but the hybrid client was repeating the ROPC flow and obtaining a new refresh token each time the user logged in after the client idle timeout expires. With this change, the tokens are obtained on login timeout. There will be a further update targeted for the next release to show the lock screen and not log the user out.
SR-C1107 · Issue 351606
Oauth tokens obtained on login timeout
Resolved in Pega Version 7.4
When the client idle time expires, the user must perform a login in order to get back into the application. If OAuth is being used for authentication there is no need to re-send the credentials to NetIQ if neither the refresh token nor access token are expired yet, but the hybrid client was repeating the ROPC flow and obtaining a new refresh token each time the user logged in after the client idle timeout expires. With this change, the tokens are obtained on login timeout. There will be a further update targeted for the next release to show the lock screen and not log the user out.
SR-C147 · Issue 343884
Security improvements for generateCellContent RUF
Resolved in Pega Version 7.4
Code changes have been made to improve security for getting the parameter value in the generateCellContent RUF.
SR-C1787 · Issue 346038
XSS filtering added for insHandle
Resolved in Pega Version 7.4
XSS filtering has been added for the inshandle parameter in the downloadFile activity.
SR-C1787 · Issue 320158
Exception message will not include invalid filename
Resolved in Pega Version 7.4
To enhance security, the exception message In the activity Rule-File-Binary.downloadFile will not display the invalid filename.
INC-150317 · Issue 625883
Certificate updates handled across nodes
Resolved in Pega Version 8.5.3
An SSL handshake exception was occurring when running a Connect-REST call automatically from the flow as a background process on a background processing node. The same Connect-REST worked fine when run manually. The exception detailed the issue as "SSLHandshakeException: java.security.cert.CertificateException: None of the TrustManagers allowed for trust of the SSL certificate(s) provided by the remote server to which this client attempted a connection." This was traced to a pulse change scenario where the reloading of the certificates was not happening on all the nodes after adding a new certificate or deleting a certificate. This has ben resolved by adding the DATA-ADMIN-SECURITY-CERTIFICATE class into the UpdatesCacheUtils.java class.
INC-153957 · Issue 615290
Cache key handling updated for OAuth2 Connect-REST
Resolved in Pega Version 8.5.3
After upgrade, a Connect-REST using OAuth2 credentials was failing with HTTP response code 403 when the Connect-REST was invoked by the agent, but the Connect-REST was successfully invoked from web node with the same Auth profile. OAuth2 tokens are stored in the cache and database. In this specific environment the key formation was happening differently on the utility node for batch processes, causing different keys to be formed for the same token. This has been resolved by adding a provider filter and updating the cache key.
INC-154311 · Issue 615684
Decryption updated for External assignment routed with DWA
Resolved in Pega Version 8.5.3
When an external assignment was routed to a user using DWA, the user was able to access the assignment but received the error "There has been an issue; please consult your system administrator" when submitting. Investigation showed this was caused by the system attempting to decrypt the External assignment with the requestor level key, causing the decryption to fail with a NumberFormatException. To resolve this, the system will check if the obfuscated string starts with Global encryption key prefix and then decrypt with the global encryption key by trimming out the prefix.
INC-154627 · Issue 619571
Re-enabled users are able to log in
Resolved in Pega Version 8.5.3
When disabled operators were re-enabled through operator management, the forced password change on next login was manually unchecked but the operators were unable to login because the change password screen was displayed without any password entry fields. This was a missed use case for handling the change password flag on a requestor , and has been resolved by having the system skip setting the change password on next login flag for disabled users.