I would like to know if the Sitecore Content Management Server security recommendation for phantom.js actually works? Has anyone successfully implemented it?
I am specifically talking about the recommendation that the dataFolder be changed from "/App_Data" to "/data". I don't understand the benefit of this and surely all sorts of things would beak if you just did that. I totally get removing phantom.js from CD servers, I also get the recommendations to restrict Sitecore account access but I don't understand moving the dataFolder and I don't think moving it in the way described in the Sitecore documentation will work.
Following is an extract from the Sitecore documentation that I am trying to follow. https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/limit-access-to-phantomjs.html " Place PhantomJS outside the webroot folder PhantomJS is located in the \$(dataFolder)\tools\phantomjs\ folder. The $(dataFolder) variable defaults to App_Data, which places PhantomJS in the \App_Data\tools\phantomjs\ folder. This can potentially give outsiders access to the phantomjs.exe program file if Sitecore security settings are not configured properly.
Sitecore references PhantomJS through the ContentTesting.PhantomJS.ExecutablePath setting in the \App_Config\Sitecore\ContentTesting\Sitecore.ContentTesting.config patch file.
To move the PhantomJS folder:
Navigate to the \App_Config\Include\ folder.
Create a patch file named, for example, MovePhantomJSFolder.config.
Insert the following configuration:
<sitecore xmlns:patch="http://www.sitecore.net/xmlconfig/" xmlns:role="http://www.sitecore.net/xmlconfig/role/" xmlns:security="http://www.sitecore.net/xmlconfig/security/"> <sc.variable name="dataFolder" value="/data" /> </sitecore>
Save the patch file. "