SA-25126

Summary

The user's application is configured with the policy name 'pxDefaultAllowAll' and mode of 'Reject and Report' in 'Integration & security' tab. A section is opened in designer studio. Immediately end user portal is launched from designer studio. Now when the user switches back to designer studio the launched portal is closed and designer studio is refreshed.

Error Messages

This error is seen in the browser developer Tools:

Refused to load the image 'data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==' because it violates the following Content Security Policy directive: "img-src *". (anonymous function) @ dvtoolbar_1781386813!!.js:4(anonymous function) @ dvtoolbar_1781386813!!.js:369

Steps to Reproduce

1. Login into designer studio.
2. Open some section rule.
3. Now launch an end user portal from designer studio.
4. Then switch back to desiger studio window, and immediately you see the issue, launched user portal is closed and designer studio is refreshed causing to loose unsaved work.
5. This happens when application is configured with policy name of 'pxDefaultAllowAll' and mode of 'Reject and Report' in 'Integration & security' tab

Root Cause

A defect in Pegasystems’ code or rules. The application has the pxDefaultAllowAll CSP and The content security policy does not generates compatible header entries.

Resolution

Apply HFix-28383