INC-185362 · Issue 668827
Keystore update properly revises the cache
Resolved in Pega Version 8.4.6
A keystore updated with the latest certificate was not getting reflected in the runtime and the old certificate was getting picked. In a multi-node environment when the new JKS is uploaded in one node, the changes are expected to be communicated to other nodes so that the cache can be cleaned up. In this case, investigation showed that the keystore label was in uppercase and the cache entry was not correctly removed. This has been resolved by adding an update that will convert the cache key to lowercase and maintain uniformity to ensure proper cleanup.
INC-186512 · Issue 669380
Password security enhanced
Resolved in Pega Version 8.4.6
Security and authentication have been enhanced for password handling.
INC-188889 · Issue 675582
New application wizard security updated
Resolved in Pega Version 8.4.6
Security around displaying and running the new application wizard has been enhanced.
INC-174321 · Issue 664240
SSLContext created using protocol from REST connector rule form
Resolved in Pega Version 8.4.6
After upgrading to IBM websphere v9.0.5.6 or higher, API calls Like REST, Connect-HTTP etc were failing to connect to endpoints using TLSv1.2. Investigation showed that although the connector was configured to send TLSv1.2, the ClientHello handshake was triggered for TLSv1.3. Because the SSLContext was created with highest version supported by protocol in the WAS container, this has been resolved by modifying the code to create SSLContext based on the the protocol selected in the REST connector rule form. Additionally, please note that the Connect-HTTP connector has been deprecated and the Connect-REST capabilities in the platform should be used instead.
INC-184756 · Issue 667323
Static assembler correctly creates temp directory
Resolved in Pega Version 8.4.6
Static Assembly CLI was failing while creating a temp directory. This was traced to an issue with staticAssembler.xml, and has been resolved. In addition, security improvements have been added to the XML transformer.
INC-190722 · Issue 676403
Ruleset Restoration Utility repaired
Resolved in Pega Version 8.4.6
Attempting to use the standard Ruleset Restoration utility after update was resulting in a "Status:fail Operator:Unauthenticated or not available Node:No ID available" error message. This was a missed use case for the refactoring done around importing rules, and was caused by the utility calling the deprecated Importable.isValidImport() method. This has been resolved by updating the import activity to restore its functionality.
INC-164775 · Issue 681241
Web page generation security updated
Resolved in Pega Version 8.4.6
Cross-site scripting protections have been enhanced around web page generation.
INC-165992 · Issue 657692
Table Filter save uses correct harness
Resolved in Pega Version 8.4.6
After creating a new view for table and then relaunching the portal or switching between tabs, the created views were not visible. Investigation showed that the views were saved under the incorrect pycaseworker harness on initial load, causing them to not be visible when returning from the switch and using the correct pyCWPortalContent harness. This has been resolved with the addition of the new parameter innerHarnessName to get the harness name when creating a personalization instance.
INC-170918 · Issue 653218
DateTime property handling revised for future date with daylight savings time
Resolved in Pega Version 8.4.6
A DateTime property was changing each time the local action refreshed. Investigation showed this was a missed use case related to recent work to correct an issue with a 1 day discrepancy for non-template DateTime. The previous update to use the default time zone when generating markup in non-template for the date property while the datetime property uses the server time zone has been further refined to handle formatting the date time when the year is greater than 2037 and combined with daylight savings time. This will be resolved by setting the correct date before returning the moment object if the year is greater than 2037 for the date time control using display mode as date.
INC-173944 · Issue 660179
Cancel button on embedded GridRow cancels single action
Resolved in Pega Version 8.4.6
When a modal Flow Action contained a Table with the Row operations configured as Master-detail and the Detail flow action was specified, if a validation error defined in a Validation rule (i.e. other than required field error) occurred while entering details for one of the rows and the Cancel button for that row was clicked, the entire action was cancelled and the modal window was closed without saving anything. This has been resolved by updating the system to prevent the modal closure if a row is added and then cancelled.