SR-B37780 · Issue 294148
Security upgrade for Struts2
Resolved in Pega Version 7.3
To improve security, Apache Struts2 has been upgraded to version 2.3.32 .
SR-B37819 · Issue 296299
SAML SessionInfo cleanup enhanced
Resolved in Pega Version 7.3
The following SAML issues have been corrected: 1) when IDP logout URL was empty, SAMLSingleLogOff activity generated an exception; 2) the SAML Session info record was not deleted during logout process even when given a valid IDP logout URL; 3) the SAML session info record was not deleted for both SP and IDP initiated logouts.
SR-B37915 · Issue 294722
Security upgrade for Struts2
Resolved in Pega Version 7.3
To improve security, Apache Struts2 has been upgraded to version 2.3.32 .
SR-B37923 · Issue 295190
null-pointer exception fixed for ForceCaseClose
Resolved in Pega Version 7.3
An exception was generated when running pxForceCaseClose due to an explicit call to the function before the Step Page was passed. This has been corrected.
SR-B37957 · Issue 303574
XSS security added for date property error message
Resolved in Pega Version 7.3
A cross site scripting filter has been added for pyErrorMessage in order to improve security.
SR-B37957 · Issue 278510
XSS security added for date property error message
Resolved in Pega Version 7.3
A cross site scripting filter has been added for pyErrorMessage in order to improve security.
SR-B37958 · Issue 296563
Radio button error highlight fixed for grids
Resolved in Pega Version 7.3
When a radio-button was configured as mandatory in a grid column, submitting the page without filling in the mandatory field did not correctly highlight the error. This was caused by the system not being able to find the correct label for the associated elements, and code has been added to find the correct label when the radio button is inside a grid.
SR-B37988 · Issue 298759
Fixed Addressing checkbox error in Connect-SOAP
Resolved in Pega Version 7.3
The addressing checkbox on the SOAP connector rule form was not being honored. This was a defect in the third party library 'praxis2-1.6.2-1.jar', and code has been added to disable the processing of WebSphere addressing headers when WebSphere addressing is false.
SR-B38034 · Issue 297014
Improved error handling for Usage Daemon
Resolved in Pega Version 7.3
The Usage daemon was exiting due to DB error and did not recover, leading to PALSnapshotImpl multiplying and causing an OOM. This was traced to missing error handling, and UsageDaemon has now been updated to handle a DB error without exiting.
SR-B38072 · Issue 297065
null-pointer exception fixed for REST XML samples
Resolved in Pega Version 7.3
The rule generation implementation for XML samples in REST wizard was faulty and throwing a NullPointerException if a resource name was the same as any of the complex node names in the sample XML. This has been fixed.