Question
IBM
CN
Last activity: 13 Jul 2023 3:00 EDT
About privilege name
About the Privilege name shown above, may I know why it's not allowed to be empty when update a rule? I found it's empty in our elder rules. My current Pega version is 8.6.6.
Also, for an activity that need call back by an URL/Post (the post requested is triggered by js function downloadFile in html paraph UserWorkForm), what privilege should be used? We hope it has most powerful access right, just like it's triggered directly by other rules like data transform.
Thanks.
Masking Technology
NL
The privilege cannot be removed when the activity can be invoked from the browser. It's for security reasons.
In older versions of pega you could have an activity that could be invoked from the browser without any privilege, making it very easy to call these activities from anywhere without proper access validation.
IBM
CN
Thanks. Could you further help to take a look at below issue
https://support.pega.com/question/activity-triggered-urlpost-request-java-script-function-fail
I guess maybe this's related to the privilege name of activity LMSDownloadAttachmentsAsZip. Currently "AllFlowActions" is used.
We hope it has most powerful access right, just like it's triggered directly by other rules like data transform. What privilege name is suggested here?