SR-D48248 · Issue 517238
Cross-site scripting filtering added to URLs
Resolved in Pega Version 8.2.5
Cross-site scripting filtering has been added to prevent the injection of a script into a URL using ViewXML.
SR-D48369 · Issue 514305
Reinitializing Full Text Search will shut down Elastic Search regardless of search initialization status
Resolved in Pega Version 8.2.5
Pega search was only sporadically working after converting from standard sandbox-marketing to largesandbox-marketing. This was traced to the Full-Text Search initialization having failed on the app-tier node during re-initialization. As part of re-initialization, the existing node is shut down and the Elastic Search node is started. The shutdown process relied on a boolean flag which indicated if the current status of full-text search initialization was successful. In this case, ES was trying to validate all the cluster level settings, for every save of one of the cluster level settings, but could not due to topology changes in the Util Tier node. The boolean flag indicated initialization had failed so the shutdown process was not invoked, yet the system was attempting to start the second instance of an ES node on the same machine. To resolve this, the shutdown FTS code has been modified to shutdown ES regardless of the search initialization status.
SR-D48960 · Issue 517879
Exception stack trace will be included as comments in generated assembly code
Resolved in Pega Version 8.2.5
When there is an exception during assembly time, that original exception message is assembled in the generated code. To improve the process of finding the the root cause by examining the original exception stack, the system has been updated to insert the original exception stack trace into the generated code as comments.
SR-D50016 · Issue 515903
Exception stack trace will be included as comments in generated assembly code
Resolved in Pega Version 8.2.5
When there is an exception during assembly time, that original exception message is assembled in the generated code. To improve the process of finding the the root cause by examining the original exception stack, the system has been updated to insert the original exception stack trace into the generated code as comments.
SR-D50161 · Issue 514822
Auto populate disabled during redux page conversion to prevent concurrent modification exception
Resolved in Pega Version 8.2.5
Running a standalone data page sourced from a look up of a class was failing sporadically with a concurrent modification exception. The Data page was backed by redux pages: this meant that when the page fetched from data source was converted to redux page, it was iterating through all properties in the mContent of the page and trying to convert those to redux properties. During this process, when any auto populate property was encountered it was getting triggered and modifying the mContent, resulting in a change in iterator. As a result, when the Iterator was trying to fetch the next element, the concurrent modification exception was thrown. To resolve this issue, auto populate has been disabled during redux page conversion to avoid unnecessary problem during data page load.
SR-D50436 · Issue 513849
Case creation service activity unauthorized response modified
Resolved in Pega Version 8.2.5
When unauthorized users accessed the URL for creating a case, a blank screen appeared instead of the user being routed to a login screen. This was due to the system returning an HTTP 400 error instead of HTTP 401 response, and was traced to the introduction of an anonymous user type in the authentication activity (Authentication service in the service package). Case creation REST service uses pzCreateCase activity to create the cases, but before introducing the anonymous user type it was exiting from the authentication activity and did not call pzCreateCase. This was traced to the error handling relying on a field value to be in English when instead the site had localized the value, causing a mismatch which did not generate the necessary failed status. To avoid this, the system will now use the new pxStatusFlowSecurity process engine status instead of relying on a text match to determine this error.
SR-D50793 · Issue 514258
PegaEmailClient Debug level EmailAccount password issue resolved
Resolved in Pega Version 8.2.5
The SendEmailNotification activity was failing to send email when DEBUG log level was enabled for the com.pega.platform.integrationengine.client.email.PegaEmailClient class. This was traced to the removal of the pyPassword property from the copied object which was done for security reasons, but which is this case led to failed authentication. This has been resolved.
SR-D56079 · Issue 517628
Content type added to Httpclientutils
Resolved in Pega Version 8.2.5
The XML Response received from Connect HTTP Service was being converted to Base64 format automatically. This was traced to there not being a content type in the response header from the service, causing the content to be treated as binary and encoded before being mapped to the clipboard. To correct this, content type has been added to Httpclientutils.
SR-D71977 · Issue 535602
Obj-Browse will retrieve more than 50 records
Resolved in Pega Version 8.5
After performing multiple skims, a newly added property was not retrieved when an Obj-Browse was performed. In Obj-Browse action, when a class is mapped to an external table and does not contain BLOB column pzpvstream, in a specific case where pxObjClass value is a reference to a parameter, a list of properties mapped to the class explicitly by querying pr4_rule_property table using NativeSQL is fetched. This call by default returns only 50 records: in cases where there are more than 50 properties for an external class, some of the properties from the obj-browse response mapping are therefore missed. To resolve this, the limit of 50 records has been removed from this NativeSQL call.
SR-D65112 · Issue 541149
Added support for imported rules to populate bixreportpage
Resolved in Pega Version 8.5
Extract rules were not holding the filter criteria after upgrade while performing save-as (for the first time) of the imported rules from the previous version. Criteria were held when the filters were created in the new version. This was caused by BIX extracts created in earlier releases (7.x) not having bixreportpage included. When an environment was upgraded to 8.x versions, opening an extract required the bixreportpage to be populated with RD metadata including the filters defined in the actual extract. Although the filters from the original extract were converted to filters that are acceptable by ReportDefinition, they were not being added to bixreportpage on opening the extract. To resolve this, the system has been updated to copy the filters back to bixreportpage on opening the extract in the upgraded environment.