SR-D78987 · Issue 544061
Support for custom jvm.args added
Resolved in Pega Version 8.2.6
In order to support Oracle PKI and other ticket based authentication, support has been added for custom jvm.args properties to setupDatabase and prpcUtils properties files.
SR-D79178 · Issue 543312
SameSite cookie setting added for Mashup support in Google Chrome v80+
Resolved in Pega Version 8.2.6
The Google Chrome browser version 80 and above now treats SameSite with a blank value as "Lax" by default, causing mashup scenarios to break. In order to compensate for this change, support has been added for setting SameSite=None in Cookie Settings in the CSRF LP (DevStudio-> System-> Setting-> CrossSiteRequestForgery) which will enforce HTTPS for the Pega server and mashup. Note: The SameSite cookie may be set to None/Lax/Strict, based on the requirement. For mashups to work, SameSite should be set as None. To follow proper security standards, it should be set as Strict.
SR-D83053 · Issue 544268
SameSite cookie setting added for Mashup support in Google Chrome v80+
Resolved in Pega Version 8.2.6
The Google Chrome browser version 80 and above now treats SameSite with a blank value as "Lax" by default, causing mashup scenarios to break. In order to compensate for this change, support has been added for setting SameSite=None in Cookie Settings in the CSRF LP (DevStudio-> System-> Setting-> CrossSiteRequestForgery) which will enforce HTTPS for the Pega server and mashup. Note: The SameSite cookie may be set to None/Lax/Strict, based on the requirement. For mashups to work, SameSite should be set as None. To follow proper security standards, it should be set as Strict.
SR-D83192 · Issue 545057
JobScheduler DST handling updated
Resolved in Pega Version 8.2.6
When the locale being used changed out of Daylight Savings Time, scheduled jobs did run at the same local time as before but instead ran an hour earlier than expected. Investigation showed that jobscheduler calculated the next runtime based on the time difference from the cluster reference time and current time in milliseconds, and this offset in milliseconds was added to next run time. Since the cluster was started in DST, the job was running on same time due to the time difference. To resolve this, the system will use a calculation offset and set hours/minutes to nextRunTime object so that calendar lib handles daylight savings.
SR-D24900 · Issue 503873
Security update for RequestMap error logging
Resolved in Pega Version 8.3.1
In HttpAPI, the RequestMap contains Cookie information. In error conditions, this map gets logged. An update has been made to ensure that the Cookie value is not logged if there is an error.
SR-D27644 · Issue 497611
Uploaded attachments will receive a unique name to prevent overwriting
Resolved in Pega Version 8.3.1
An issue with an incorrect file being attached to a work object was traced to overlapping processes. When files are uploaded, they are first saved to common HDD directory and then read into memory and deleted from the HDD area. Files will overwrite other file carrying the same name, which is a problem if the first file is not completely uploaded and is waiting in the common directory and some other file with the same name is uploaded on top of it. To resolve this, an update has been made to ensure file names are appended with a unique identifier to distinguish between files carrying the same names and keep them from overwriting each other.
SR-D28184 · Issue 497165
Verbose debug logging removed from LockUtils
Resolved in Pega Version 8.3.1
Verbose debug logging that had been added to the "LockUtils" class to print when the lock was acquired or released and include the associated stacktrace has now been removed as it interfered with diagnosing locking issues when threads were getting blocked.
SR-D28538 · Issue 502056
Corrected requestor status flag for direct map
Resolved in Pega Version 8.3.1
Numerous "Unable to create requestor" alerts were logged. This was traced to an error in HttpAPI where after retrieving the requestor from the internal requestor map directly, the requestor creation status flag was not set properly. This caused last action to post that alert instead of the correct notice of "existing requestor retrieved". This has been resolved so the flag reflects the correct status.
SR-D31066 · Issue 502252
Improved performance for "Show-HTML" in a grid with numerous controls
Resolved in Pega Version 8.3.1
‘Show-HTML’ was taking an excessive amount of time to render a UI for grid with a large number of controls. This was traced to the handling for generating and clearing markup creating an exponential growth situation, and has been resolved by modifying the system to remove redundant copies of a string in the markup string buffer.
SR-D33491 · Issue 511726
Code fragment removed to resolve CookieDisabledException
Resolved in Pega Version 8.3.1
After upgrade, a CookieDisabledException occurred after a post activity was invoked in the single sign-on (SSO) authentication service. This was traced to the site using the deprecated flag "redirectguests" as part of SSO-based login for mashup usecases. This flag was used to check if a cookiedisabled exception was thrown or not, and if there was no cookie, if a requestor was authenticated in first request. However, the flag has been removed as part of work done to omit the Cookie support check on Mobile App UAs. Code that supported the use of this flag remained after that work and led to the exception being generated, but has now been removed as well.