Error 403 Forbidden when typing an If conditional when making an Edit Input Java code
I'm trying to type the next code to make a small test in regards to formatting a string as the user types it:
if(theValue.length() == 3){
theValue += ".";
}
I would expect this to work without any issue, but when I go ahead and save it, and then click on "Refresh", I get a 403 Forbidden error, which forces me to close the tab, just to find the previous code when I reopen it, so the code isn't even saving to begin with apparently.
I don't understand if there's something I'm missing, but I don't get why a simple If conditional would cause an error.
***Edited by Moderator Marije to add Capability tags***
Pegasystems Inc.
GB
@JuanN510 can you confirm if your logs show the error "You are not authorized to perform this Action".?
I can't help but feel this issue is related to Basic Access Control (BAC) Resources
https://docs-previous.pega.com/secu0019-alert-unauthorized-request-detected
https://community.pega.com/knowledgebase/articles/security/85/verify-requests-application-layer https://community.pega.com/knowledgebase/articles/security/85/using-access-control-checks https://community.pega.com/knowledgebase/articles/security/85/identifying-custom-controls-configure
wrt the Run rule (when running java script) . As far as I understand it, one of the benefits of locking down a system with BAC is only allow specific, registered activity calls. However, features like Run Rule allows users to execute any activity with only normal security and rule resolution limitations. So, I would expect activities such as pzRunRecordExecute, RunRuleExecute, and pzRunActionWrapper to be locked down.
Can you try modifying pyBlockUnregisteredRequests (>6) to false and disable 'pyShowSecureWarningFeature' - does this remove the problem?
Pega 8.5 implemented a new security check where all custom javascript requires to be registered.
@JuanN510 can you confirm if your logs show the error "You are not authorized to perform this Action".?
I can't help but feel this issue is related to Basic Access Control (BAC) Resources
https://docs-previous.pega.com/secu0019-alert-unauthorized-request-detected
https://community.pega.com/knowledgebase/articles/security/85/verify-requests-application-layer https://community.pega.com/knowledgebase/articles/security/85/using-access-control-checks https://community.pega.com/knowledgebase/articles/security/85/identifying-custom-controls-configure
wrt the Run rule (when running java script) . As far as I understand it, one of the benefits of locking down a system with BAC is only allow specific, registered activity calls. However, features like Run Rule allows users to execute any activity with only normal security and rule resolution limitations. So, I would expect activities such as pzRunRecordExecute, RunRuleExecute, and pzRunActionWrapper to be locked down.
Can you try modifying pyBlockUnregisteredRequests (>6) to false and disable 'pyShowSecureWarningFeature' - does this remove the problem?
Pega 8.5 implemented a new security check where all custom javascript requires to be registered.
These warnings are observed due to BAC validation. To identify the rules that you need to configure, see Identifying the custom controls to configure.
All the unregistered activities noticed in Secu0019 alerts need to registered/encrypted to prevent BAC issue. As a workaround, disable 'pyShowSecureWarningFeature' and 'pyBlockUnregisteredRequests' when rules to avoid BAC issues.
If we set the pyBlockUnregisteredRequests when rule as False then this issue should not be occurring, but in this way, we are suppressing the access violation issues instead of fixing the issues.
We recommend you to fix the behavior of the non-autogenerated control that invokes the specified activity.
There are three ways to register the rule or encrypt the URL to prevent this alert from being logged, depending on the rule type.
- Configuring the custom control by using the rule form — Use the rule form when a control such as a button calls the
Run Scriptaction, which in turn calls a custom function. - Configuring the custom control by encrypting the URL in JavaScript — Use JavaScript when you cannot use the rule form and your control calls custom JavaScript.
- Configuring the custom control by registering the action page in Java — Use Java when your control calls a custom rule (other than a function) and you do not have access to JavaScript.
Please use the below links for more details.
https://collaborate.pega.com/question/popup-about-access-control-warning-post-upgrade-85 https://community.pega.com/knowledgebase/articles/security/85/verifying-requests-when-using-custom-controls https://community.pega.com/knowledgebase/articles/security/85/verify-requests-application-layerhttps://community.pega.com/knowledgebase/articles/security/85/using-access-control-checks