SR-D23239 · Issue 499591
Support added for multi-operator SAML logins
Resolved in Pega Version 8.4
When a SAML user logged in by Single Sign-On (SAML), the system processed the login to portal as a different operator if there was a function on the Attribute field under Operator identification in the SAML authentication service. In this scenario, using an expression for operator provisioning did not work because all SAML login sessions resolved to same first operator due to parseAndEvaluateExpression() in ExpressionHelper.java ignoring new expression arguments if the expression page already existed. To support the use of multiple operator logins in this format, the system has been updated to clone a new expression page for every session and update it with the correct expression arguments.
SR-D31734 · Issue 515657
XSS protection added for parameter page properties
Resolved in Pega Version 8.4
An XSS vulnerability was seen with the Edge browser when run on visibility on client check was enabled with dynamic layouts and some properties were accessed from parameter page. Because run on visibility on client check is not required in this scenario, is has been removed and the values will be accessed from the server instead.
SR-D47685 · Issue 514647
Cookie logging restored
Resolved in Pega Version 8.4
As part of security updates, Cookies were restricted from being logged. However, this caused some business use cases such as a custom function call to obtain the list of cookies that are present in the application to stop working. To resolve this, the cookie logging restriction has been reverted.
SR-D22505 · Issue 493366
Circumstancing template and definitions assembly modified to avoid calling RD
Resolved in Pega Version 8.4
After deploying a new rollout, errors such as "Only authenticated client may start this activity: RULE-OBJ-ACTIVITY RULE-OBJ-REPORT-DEFINITION" and "You lack access required to execute RULE-OBJ-ACTIVITY RULE-OBJ-REPORT-DEFINITION" appeared. Investigation showed that during an unauthenticated session, executing Report Definitions or accessing database (with securityCheck enabled) are not allowed. When someone wants to use circumstanced rules during the custom authentication process, and if the circumstancing rules are not assembled yet, then assembly of the circumstanced rules triggers the assembly of circumstance template and definitions. During this process the system used Report definition, but since execution of RD is not allowed without authentication the assembly was failing. This has been resolved with two changes: the MergeDefintions activity which is invoked during assembly of CircumstanceTemplate : database.open() has replaced the pxRetrieverReportData activity (which invokes RD to fetch circumstances definitions), and the GetAllDefinitionRows activity which is invoked from MergeDefinitions : database.open has replaced Obj-open in step 3.
SR-D24900 · Issue 503875
Security update for RequestMap error logging
Resolved in Pega Version 8.4
In HttpAPI, the RequestMap contains Cookie information. In error conditions, this map gets logged. An update has been made to ensure that the Cookie value is not logged if there is an error.
SR-D27644 · Issue 497614
Uploaded attachments will receive a unique name to prevent overwriting
Resolved in Pega Version 8.4
An issue with an incorrect file being attached to a work object was traced to overlapping processes. When files are uploaded, they are first saved to common HDD directory and then read into memory and deleted from the HDD area. Files will overwrite other file carrying the same name, which is a problem if the first file is not completely uploaded and is waiting in the common directory and some other file with the same name is uploaded on top of it. To resolve this, an update has been made to ensure file names are appended with a unique identifier to distinguish between files carrying the same names and keep them from overwriting each other.
SR-D28083 · Issue 512937
DeleteOrphanStaticContent CacheConfigID populated on node startup
Resolved in Pega Version 8.4
The pzDeleteOrphanStaticContent activity which triggers to clear cache was unable to clear the files in the static content folder and in the database when the files were more than one week old. In order to correctly cleanup old static content, pzAsmCacheConfigID must be populated in py_sys_statusnodes. However, when SystemNodesDAO was introduced to populate pr_sys_statusnodes, pzAsmCacheConfigID was not populated. To resolve this, pzAsmCacheConfigID is now populated on node startup when node information is added to pr_sys_statusnodes.
SR-D28184 · Issue 497168
Verbose debug logging removed from LockUtils
Resolved in Pega Version 8.4
Verbose debug logging that had been added to the "LockUtils" class to print when the lock was acquired or released and include the associated stacktrace has now been removed as it interfered with diagnosing locking issues when threads were getting blocked.
SR-D28538 · Issue 502058
Corrected requestor status flag for direct map
Resolved in Pega Version 8.4
Numerous "Unable to create requestor" alerts were logged. This was traced to an error in HttpAPI where after retrieving the requestor from the internal requestor map directly, the requestor creation status flag was not set properly. This caused last action to post that alert instead of the correct notice of "existing requestor retrieved". This has been resolved so the flag reflects the correct status.
SR-D31066 · Issue 502254
Improved performance for "Show-HTML" in a grid with numerous controls
Resolved in Pega Version 8.4
‘Show-HTML’ was taking an excessive amount of time to render a UI for grid with a large number of controls. This was traced to the handling for generating and clearing markup creating an exponential growth situation, and has been resolved by modifying the system to remove redundant copies of a string in the markup string buffer.