Require to customize xmlstatus.jsp as per our security standards
As per security standard , it requires not to show exception details to user whenever error is occurred. Therefore, we're looking to customize xmlstatus.jsp not to show. exception details. Please find the both attachments customizable xml status and original xml status jsp files with this. Please review customizable xml status jsp and let me know if there is any impact of modified xml file.
Location of xml status jsp : prweb/diagnostic/xmlstatus.jsp
***Edited by Moderator Marissa to update categories***
Pegasystems Inc.
US
Would recommend you try the DisplayExceptionTraceback security setting.
See the following article for specifics on implementing the setting as well as several other recommended security settings:
https://docs-previous.pega.com/security-settings-prconfigxml-file
Ally Financial
US
Hi,
Thanks for your response, it looks we are in same page now. However, we do have setting with "false" for DisplayExceptionTraceBack for DSS.
While I verified status.jsp file, I found the content like below
<table>
<tr>
<td class="StatusHeader">Status</td>
<td><%= sStatus %></td>
</tr>
<tr>
<td class="StatusHeader">Message</td>
<td><%= sMessage %></td>
</tr>
<tr>
<td class="StatusHeader">Operator ID</td>
<td><%= sUserName %></td>
</tr>
<tr>
<td class="StatusHeader">Requestor ID</td>
<td><%= sRequestorID %></td>
</tr>
<tr>
<td class="StatusHeader">Timestamp</td>
<td><%= new Date(System.currentTimeMillis()) %></td>
</tr>
<tr>
<td class="StatusHeader">Engine Version</td>
<td><%= sETierVersion %></td>
</tr>
/table>
Hi,
Thanks for your response, it looks we are in same page now. However, we do have setting with "false" for DisplayExceptionTraceBack for DSS.
While I verified status.jsp file, I found the content like below
<table>
<tr>
<td class="StatusHeader">Status</td>
<td><%= sStatus %></td>
</tr>
<tr>
<td class="StatusHeader">Message</td>
<td><%= sMessage %></td>
</tr>
<tr>
<td class="StatusHeader">Operator ID</td>
<td><%= sUserName %></td>
</tr>
<tr>
<td class="StatusHeader">Requestor ID</td>
<td><%= sRequestorID %></td>
</tr>
<tr>
<td class="StatusHeader">Timestamp</td>
<td><%= new Date(System.currentTimeMillis()) %></td>
</tr>
<tr>
<td class="StatusHeader">Engine Version</td>
<td><%= sETierVersion %></td>
</tr>
/table>
Due to presence of above code, it's logged in the security, If I remove for Engine Version , Message, Requestor ID and Timestamp, does it cause any impact in other scenarios.
it looks if I run the activity standalone, the status.jsp is invoked for any error scenario.
Ex: I put one step with Obj-Open and have given key value which does not exist in pr_operators table.
Then I reproduce with content of status.jsp , Now my question, if I change which I mentioned in above, does it cause any impact.
Moreover, what is the significance of xmlstatus.jsp file.
Pegasystems Inc.
US
Hi pavang44,
These three jsp pages can be modified to reflect whatever you would like to display. There is currently no documentation available that describes how to customize said files, and any such modifications may need to be revisited following product upgrades (as the files will be replaced).
error.jsp
xmlstatus.jsp
status.jsp
You may also want to review this post as well: https://collaborate.pega.com/question/pega-716-display-user-friendly-message-all-errorsexceptions-thrown-pega-ui
Ally Financial
US
Hi,
Thanks for quick response.
I completely agree with you that it requires to modify above files what I would like to display,
My Question , what is the impact if we remove fields such as status, requestor , message , Timestamp and Engine version in status.jsp and xmlstatus.jsp file.
If I remove these fields, it would not get logged in security scan, it works fine. Perfect, no issues.
But does it cause any impact or we loose any functionality , We would like to confirm impact scenarios before apply changes in production.
Thanking you in anticipation.
Pegasystems Inc.
US
Hi pavang44,
If you want to remove the fields from showing up and just put a generic message there, that is an option. You would need to test and validate how it displays to the user, but removing fields shouldn't be a problem.