INC-139300 · Issue 590273
Additional security for encrypted passwords
Resolved in Pega Version 8.3.5
Handling and cleanup has been updated for encrypted values to enhance security.
INC-141296 · Issue 592474
Log-access security updated
Resolved in Pega Version 8.3.5
Access control has been updated for Log-Usage class.
INC-139337 · Issue 595222
RefreshRequestors security update
Resolved in Pega Version 8.3.5
Security improvements have been added for RefreshRequestors.
INC-135349 · Issue 583004
Unit Test Ruleset rules do not count against Guardrails
Resolved in Pega Version 8.3.5
Although the documentation indicates that rules in a Unit Testing ruleset should not count against the guardrail score or unit test coverage, when branching a unit test ruleset, the branch did not carry the same unit test flag value as the source ruleset and the rulesets were counted as a result. This has been resolved with an update to ignore testrulesets in guardrail and pegaunit calculations.
INC-128923 · Issue 594162
Cross-site scripting security update
Resolved in Pega Version 8.3.5
Cross-site scripting protections have been added to OpenNoteDetails.
INC-143136 · Issue 604016
Cross-site scripting update
Resolved in Pega Version 8.3.5
Cross-site scripting protections have been updated in Designer Studio.
INC-128880 · Issue 592817
Handling added for angle brackets in legacy Chart control
Resolved in Pega Version 8.3.5
When using Investigative Case Management, some report charts were not rendering correctly. This has been resolved by updating appendFormattedString in AbstractJsonDataGenerator.java to escape angled brackets (< and >) before appending the input.
INC-141322 · Issue 594513
Resolved drill up doubling the filter box
Resolved in Pega Version 8.3.5
When opening a report with a visual graph, clicking on one of the filtered options, leaving this box open (not submitting it) and then clicking on a bar in the visual graph of the report showed the contents of the graph, but then clicking on the report link to go back to the report overview caused a doubled filter box to be displayed. The report would then have to be reopened before being able to continue. The problem was that the value of .pyUI.pyConfigSecToShow was still set to "filter" after the drill down. When the drill back up happened, the report was trying to show the filter configuration section from before but the context was no longer available and it failed. This has been resolved by adding a call to pzCancelFilterLogicChanges in pzDrillUpReport to set the filters to the previous values and reset the value of pyConfigSecToShow.
INC-137317 · Issue 585404
Security improved for searches
Resolved in Pega Version 8.3.5
Authentication requirements have been added to activities associated with searching.
INC-139700 · Issue 591563
Shortcut works for copying reports into private rulesets
Resolved in Pega Version 8.3.5
Copying out of the box shortcuts to other categories in the Report Browser was failing with the error ".pyShortcutName: The rule name pyTimePerStage is a reserved name (starts with px, py, or pz) and is not created in a Pega- ruleset." This was caused by the system trying to create a new rule with a py prefix in a non pega- ruleset, which was a missed use case in the refactoring work of report actions to use the Record API. This has been corrected by moving the report ID generation logic from the activity pzValidateSaveAsInput to a new Rule-Utility-Function in the ReportingUtils library called pzGenerateUniqueRecordName so that it can also be used by pzCopyShortcutPostActivity7 when the shortcut's ID is prefixed with px, py, or pz.