SR-D23239 · Issue 499591
Support added for multi-operator SAML logins
Resolved in Pega Version 8.4
When a SAML user logged in by Single Sign-On (SAML), the system processed the login to portal as a different operator if there was a function on the Attribute field under Operator identification in the SAML authentication service. In this scenario, using an expression for operator provisioning did not work because all SAML login sessions resolved to same first operator due to parseAndEvaluateExpression() in ExpressionHelper.java ignoring new expression arguments if the expression page already existed. To support the use of multiple operator logins in this format, the system has been updated to clone a new expression page for every session and update it with the correct expression arguments.
SR-D31734 · Issue 515657
XSS protection added for parameter page properties
Resolved in Pega Version 8.4
An XSS vulnerability was seen with the Edge browser when run on visibility on client check was enabled with dynamic layouts and some properties were accessed from parameter page. Because run on visibility on client check is not required in this scenario, is has been removed and the values will be accessed from the server instead.
SR-D47685 · Issue 514647
Cookie logging restored
Resolved in Pega Version 8.4
As part of security updates, Cookies were restricted from being logged. However, this caused some business use cases such as a custom function call to obtain the list of cookies that are present in the application to stop working. To resolve this, the cookie logging restriction has been reverted.
INC-127591 · Issue 564820
isAuthenticated checks trimmed for Performance Improvement
Resolved in Pega Version 8.4.2
In order to improve performance, a duplicate check of pxIsRepositoryAuthenticated has been removed from the Function Rule.
INC-127859 · Issue 564621
Email image retrieval switched to Lazy Load
Resolved in Pega Version 8.4.2
In email, multiple images being loaded at once resulted in a performance impact. To resolve this, the fetching of inline images has been modified to use Lazy Load optimization which will retrieve file content from S3 storage on a need basis.
INC-127891 · Issue 564728
Added check for redirects when getting images from S3
Resolved in Pega Version 8.4.2
When retrieving images from S3 storage, a 303 redirect status response code was shown. Investigation showed that using a public URL caused the redirects, and this has been resolved by adding an AG hash while fetching images via an activity.
INC-128164 · Issue 567430
Resolved CommitError when trying to send email
Resolved in Pega Version 8.4.2
An error related to email was intermittently encountered while working on a case. This was traced to a local setting for Rule-ObJ class that set a read-only privilege, which appeared to have conflicted with the expected permissions around email template saving. This was an unexpected use case, and has been resolved.
SR-D87188 · Issue 551351
Mentioned user in Pulse correctly converted to hyperlink
Resolved in Pega Version 8.4.2
In the Interaction portal, mentioning a user in Pulse using @ was not converting the name to the user name with hyperlink for Email Interactions. @ mentions were working as as expected in Phone Interactions. This problem was introduced as part of using OWASP to sanitize HTML user input in Rich Text support, and was due to OWASP converting @ to an HTML entity. To resolve this, the @ will be excepted from HTML conversion.
SR-D87412 · Issue 563229
Support added for multi-language email parsing
Resolved in Pega Version 8.4.2
Parsing an email body for different languages was causing performance issues. To resolve this, an enhancement has been added to support email IVA in seven languages; to use this, override the Work-Channel-Triage.pyParseReplyMail activity and add the required languages in the given parameter.
SR-D92688 · Issue 551342
Optional feature to improve pxETReport performance
Resolved in Pega Version 8.4.2
Poor performance was seen when using pxETReport. This was caused by the system loading the recent cases widget by looking up all the ET cases within last 30 days, opening each ET case to check if it is from the same pyFrom email address, and then if yes, opening its related service case. On a complex system, this was potentially a slow process. To improve performance, the "Related cases" feature can now be disabled through an overridable 'when' rule.