Release 1.10.0-beta.1

* only allow cors when using a special flag

* add docs about --allow-cors flag

docs/en/contributing-to-appium/developers-overview.md

@@ -180,8 +180,7 @@ converted into the `npm-shrinkwrap.json` file.
 1. Determine whether we have a `patch` (bugfix), `minor` (feature), or `major` (breaking) release according to the principles of SemVer.
 1. Update `package.json` with the appropriate new version.
 1. Update the CHANGELOG/README with appropriate changes and submit for review as a PR, along with shrinkwrap and `package.json` changes. Wait for it to be merged, then pull it into the release branch.
-1. `rm -rf node_modules && npm install --production` to get just the production dependencies.
-1. `npm shrinkwrap` to write the new NPM shrinkwrap JSON file, and commit this file.
+1. Run `npm run prod-shrinkwrap` to install just the production dependencies and create a shrinkwrap that only locks production dependencies.
 1. Create a tag of the form `v<version>` on the release branch (usually a minor branch like `1.5` or `1.4`), with: `git tag -a v<version>`, e.g., `git tag -a v1.5.0`. This is not necessary for beta versions.
 1. Push the tag to upstream: `git push --tags <remote> <branch>`
 1. Install dev dependencies (or at least `gulp` and `appium-gulp-plugins`), and undo the changes to the NPM shrinkwrap JSON file (e.g., `git checkout -- npm-shrinkwrap.json`).

docs/en/writing-running-appium/server-args.md

@@ -14,6 +14,7 @@ All flags are optional, but some are required in conjunction with certain others
 |Flag|Default|Description|Example|
 |----|-------|-----------|-------|
 |`--shell`|null|Enter REPL mode||
+|`--allow-cors`|false|Turn on CORS compatibility mode, which will allow connections to the Appium server from within websites hosted on any domain. Be careful when enabling this feature, since there is a potential security risk if you visit a website that uses a cross-domain request to initiate or introspect sessions on your running Appium server.||
 |`--ipa`|null|(IOS-only) abs path to compiled .ipa file|`--ipa /abs/path/to/my.ipa`|
 |`-a`, `--address`|0.0.0.0|IP Address to listen on|`--address 0.0.0.0`|
 |`-p`, `--port`|4723|port to listen on|`--port 4723`|

lib/main.js

@@ -122,7 +122,12 @@ async function main (args = null) {
   await logStartupInfo(parser, args);
   let appiumDriver = new AppiumDriver(args);
   let router = routeConfiguringFunction(appiumDriver);
-  let server = await baseServer(router, args.port, args.address);
+  let server = await baseServer(router, args.port, args.address, args.allowCors);
+  if (args.allowCors) {
+    logger.warn('You have enabled CORS requests from any host. Be careful not ' +
+                'to visit sites which could maliciously try to start Appium ' +
+                'sessions on your machine');
+  }
   appiumDriver.server = server;
   try {
     // TODO prelaunch if args.launch is set

lib/parser.js

@@ -13,6 +13,15 @@ const args = [
     dest: 'shell',
   }],
 
+  [['--allow-cors'], {
+    required: false,
+    defaultValue: false,
+    action: 'storeTrue',
+    help: 'Whether the Appium server should allow web browser connections from any host',
+    nargs: 0,
+    dest: 'allowCors',
+  }],
+
   [['--reboot'], {
     defaultValue: false,
     dest: 'reboot',

package.json

@@ -11,7 +11,7 @@
     "firefoxos",
     "testing"
   ],
-  "version": "1.9.2-beta.2",
+  "version": "1.10.0-beta.1",
   "author": "https://github.com/appium",
   "license": "Apache-2.0",
   "repository": {
@@ -84,7 +84,7 @@
     "coverage": "gulp coveralls",
     "generate-docs": "node ./build/commands-yml/parse.js",
     "clean": "rm -rf node_modules && rm -rf package-lock.json && npm install",
-    "clean:prod": "rm -rf node_modules && rm -rf package-lock.json && npm install --production",
+    "shrinkwrap-prod": "rm -rf package-lock.json && npm prune --production && npm shrinkwrap",
     "zip": "zip -qr appium.zip .",
     "upload": "node ./build/test/scripts/bintray-upload.js",
     "zip-and-upload": "npm run zip && npm run upload",