Skip to main content

Resolved Issues

View the resolved issues for a specific Platform release.

Go to download resolved issues by patch release.

Browse release notes for a selected Pega Version.

NOTE: Enter just the Case ID number (SR or INC) in order to find the associated Support Request.

Please note: beginning with the Pega Platform 8.7.4 Patch, the Resolved Issues have moved to the Support Center.

SR-D30215 · Issue 503682

cross-site scripting protection added to ClientDynamicData

Resolved in Pega Version 8.2.4

Cross-site scripting protection has been added to the "DesignViewIframe" & "pzHarnessID" parameters in the pzClientDynamicData HTML rule.

SR-D25972 · Issue 501482

Handling added for custom error message in post-authentication activity

Resolved in Pega Version 8.2.4

The error message in post authentication activity was always appearing as 'Login terminated because a post-authentication activity or policy failed' irrespective of the actual message being conditionally set in the activity based on post authentication logic. Investigation showed that the parameter page in the SSO post-authentication activity was not being passed to the 'pzShowAuthPolicyError' activity due to the post-authentication activity executing in authenticated context whereas the HTML fragment executed in the un-authenticated context. In order to support this use, post-authentication activity will set the error message on a predefined property and propagate that to the HTML fragment by appending the error message as a query parameter in the redirect exception URL post-authentication failure.

SR-D23862 · Issue 503896

Corrected test connection for LDAP AuthService using keystore

Resolved in Pega Version 8.2.4

When using a AuthService rule defined for LDAP using ldaps:// and a KeyStore rule that was defined to reference a local file in the server, the Test Connection button on the AuthService rule did not work and generated the following exception: "com.pega.apache.commons.httpclient.contrib.ssl.AuthSSLInitializationError: I/O error reading keystore/truststore file: null". Investigation showed that file reference keystore did not work with an LDAPS test connection because while run time used the LDAPVerifyCredentials activity, the design time validation used the activity “ValidateInfrastructure” which did not have the required code to support file reference keystore. This has been corrected.

SR-D21803 · Issue 502130

Cross-site scripting protection added for embedded portal URI

Resolved in Pega Version 8.2.4

The URI used in the top window of embedded portals has been encoded to prevent DOM based cross-site scripting.

SR-D29485 · Issue 503511

Enhancement added to modify URL encryption for load testing

Resolved in Pega Version 8.2.4

An enhancement has been added which allows conditionally modifying URL encryption for load testing. This uses the flag crypto/useportablecipherforurlencryption: if true, a portable hardcoded key is used to encrypt the URLs and if false, a dynamically generated key per thread/requestor is used to encrypt the URL.

SR-D38581 · Issue 504775

Removed unnecessary cross-site scripting filtering on paragraph rule

Resolved in Pega Version 8.2.4

When a link was set in a paragraph rule, the target option was removed in the returned layout structure. This was traced to unnecessary XSS filtering which has now been removed.

INC-157095 · Issue 638808

Enhancement added for tenant-level authentication

Resolved in Pega Version 8.7

In a multi-tenant PDC with a few tenants that utilize their own custom SSO, a pre-authentication activity inside a tenant that should block community access was also affecting tenants that did not have that pre-auth activity set. This was a missed use case and has been resolved by adding a tenantId hash in SchemePRAuth.makeUniqueSchemeName() to create the authServiceName.

INC-162434 · Issue 640051

LookUpList correctly executes during SSO login with model operator

Resolved in Pega Version 8.7

After configuring SSO to create operators on fly using a model operator, a new user logging in for the very first time had their operator ID created using the model operator, but after upgrade new users logging in to the system received the error "Only authenticated client may start this activity: RULE-OBJ-ACTIVITY @BASECLASS LOOKUPLIST". This was due to the methods used for additional security on the activity @baseclass LookUpList which allows it to only be run by authenticated users, and has been resolved.

INC-163201 · Issue 646910

BrowserFingerprint updated

Resolved in Pega Version 8.7

Security improvements have been added to the browser fingerprint process.

INC-163914 · Issue 668846

Improved Agile Studio passivation recovery

Resolved in Pega Version 8.7

When an Agile Studio session was passivated, the error "SECU0008 : CSRF Detected and Blocked" was seen. Reactivating the session resulted in a blank page. This was traced to the clearing of requestor level registrations added for that particular thread, and has been resolved by adding a new flag to identify if a thread is passivated along with the necessary structure for the conditionalized clearing of requestor level registrations based on this flag.

We'd prefer it if you saw us at our best.

Pega.com is not optimized for Internet Explorer. For the optimal experience, please use:

Close Deprecation Notice
Contact us