I would like to know if the Sitecore Content Management Server security recommendation for phantom.js actually works? Has anyone successfully implemented it?
I am specifically talking about the recommendation that the dataFolder be changed from "/App_Data" to "/data". I don't understand the benefit of this and surely all sorts of things would beak if you just did that. I totally get removing phantom.js from CD servers, I also get the recommendations to restrict Sitecore account access but I don't understand moving the dataFolder and I don't think moving it in the way described in the Sitecore documentation will work.

Following is an extract from the Sitecore documentation that I am trying to follow. https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/limit-access-to-phantomjs.html " Place PhantomJS outside the webroot folder PhantomJS is located in the \$(dataFolder)\tools\phantomjs\ folder. The $(dataFolder) variable defaults to App_Data, which places PhantomJS in the \App_Data\tools\phantomjs\ folder. This can potentially give outsiders access to the phantomjs.exe program file if Sitecore security settings are not configured properly.

Sitecore references PhantomJS through the ContentTesting.PhantomJS.ExecutablePath setting in the \App_Config\Sitecore\ContentTesting\Sitecore.ContentTesting.config patch file.

To move the PhantomJS folder:

Navigate to the \App_Config\Include\ folder.

Create a patch file named, for example, MovePhantomJSFolder.config.

Insert the following configuration:

    <sc.variable name="dataFolder" value="/data" />

Save the patch file. "

  • Have you actually tried doing anything at all here? If so, what were the error messages? – Mark Cassidy Mar 9 '20 at 17:35
  • I got a "Required license is missing: Runtime" - this is obvious given that license.xml sits in App_data and Sitecore is probably looking for it under /data. If I move license.xml to /data then Sitecore seems to work (i did not thoroughly test) ... but I still don't see the point of moving the folder from /App_Data to /data. – S Prod Mar 10 '20 at 9:34

Having read that I think it's a bit of a strange wording. I believe you have two options here.

  1. Follow the article you linked to and move the entire datafolder to /data instead.
  2. If you only want to patch the location of PhantomJS, you can create a slightly different patch, to change the setting of ContentTesting.PhantomJS.ExecutablePath instead:

    <configuration xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/">
          <setting name="ContentTesting.PhantomJS.ExecutablePath" value="your/path/to/phantomjs.exe" />

This patch file should then be put in your App_Config/Include folder.

Please note with either option you need to keep the datafolder inside the webroot.

  • Thanks Trayek, I have tried various combinations of this and I have to conclude that there is a bug in Sitecore 9.0 that actually does not take this setting into consideration. I copied the phantomjs folder to a new location leaving the old folder intact minus the exe file. I changed the setting and checked showconfig and double checked the path on the command prompt. PhantomJS would not work until I copied the exe back to the original location even though I deleted it from the new location that the setting was pointing too! – S Prod Mar 12 '20 at 8:47
  • 1
    I got a note from Sitecore support - they are going to update the documentation. – S Prod Mar 18 '20 at 8:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.