SR-A12775 · Issue 236646
ChangePassword screen now allows custom messages
Resolved in Pega Version 7.2.1
The pzChangePassword activity has been enhanced to allow customizing the change password screen
SR-A14879 · Issue 232530
Improved security for JSON stack
Resolved in Pega Version 7.2.1
To increase security, the response to invalid JSON input will display a generic InvalidStream message rather than the full class name and method name. The complete information will be available in the log.
SR-A15922 · Issue 231258
Support added for cleartext passwords in Snapstart
Resolved in Pega Version 7.2.1
When posting credentials from an external source, the code makes the assumption that the Password value is encoded and therefore it is decoded prior to being handed to the authentication activity in Pega. This is not always the case. If the Password value is passed as clear text the result in the activity is garbled. This creates problems when subsequent authentication is attempted to an external source. To support this handling, a new DASS 'authentication/Snapstart/pwddecode' has been added. When the setting is false, the password is not decoded in Snapstart cases and will necessitate a cleartext password.
SR-A16543 · Issue 235300
Resolved Interaction Portal unexpected close
Resolved in Pega Version 7.2.1
In Google Chrome, launching a secondary portal and encountering a Content Security Policy issue relating to an image caused the secondary portal to automatically close and the developer portal to be refreshed. This was an issue with a mismatch in the pyrequestor token, and has been corrected.
SR-A16960 · Issue 233576
Predictive Analytics rulesets excluded from RSA
Resolved in Pega Version 7.2.1
The Pega-provided Predictive Analytics rulesets were being incorrectly being checked and flagged by the Rule Security Analyzer. The PAD rulesets have now been properly excluded from the RSA check, and further analysis was done to find and fix other RSA flags that should have been excluded.
SR-A19297 · Issue 237347
Added ability to set custom HTTP security headers
Resolved in Pega Version 7.2.1
XSS protections were interfering with the ability to set custom HTTP headers. To enable this, the system will use dynamic system settings from http/responseHeaders and add them to every HTTP response.
SR-A21378 · Issue 245075
Resolved Interaction Portal unexpected close
Resolved in Pega Version 7.2.1
In Google Chrome, launching a secondary portal and encountering a Content Security Policy issue relating to an image caused the secondary portal to automatically close and the developer portal to be refreshed. This was an issue with a mismatch in the pyrequestor token, and has been corrected.
SR-A22198 · Issue 244738
Empty access groups handling added for organizational instance
Resolved in Pega Version 7.2.1
If an unauthenticated access group was configured in the organizational instance, errors occurred because the organization instance access groups are only considered for session authorization once the user is authenticated. This will now be handled through a validate activity change in the Data-admin-organization to honor the emptiness of access groups
SR-A24508 · Issue 246983
Apache Struts updated for security
Resolved in Pega Version 7.2.1
Apache Struts has been updated to version 2.3.28 to protect against potential security vulnerabilities exposed when Dynamic Method Invocation is enabled, removing the ability for remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
INC-147654 · Issue 642186
Updates to displaying embedded images in cases
Resolved in Pega Version 8.3.6
Sending an email with an embedded image to the email ID associated with the email listener successfully created the interaction case, but the embedded image was not displayed when the case was opened from the work-basket. A rule-not found exception was seen in the tracer for pyGetImageDisplay, the rule responsible for displaying the images in the ET pane. Investigation showed that when URLObfuscation was turned on, the decryption of the URL was not successful because "&" had been encoded to '& amp;'. This has been resolved by calling the activity pyGetImageForDisplay using URLMapping instead. An additional issue was seen with displaying images in the email interaction pane where the additional empty new lines moved the image outside the intended place. This was traced to a customization for the reply area which used the pyHighlightedMessage property and converted newlines to br tags even in HTML mode. To resolve this, pyHighlightedMessage has ben modified to convert newlines to br tags only if the mode is plain text.