When defining a Make file, you can't currently control the download contrib destination per project, only globally. This means all module projects are downloaded and restricted to something like "sites/all" by default. If you are using multisite and need to download different modules to different subdirectories, then you can't currently manage that will one drush make call. Likewise, if you want to update modules in a profile, the same issue applies.
This patch amends that be enabling contrib_destination to be controlled per project. However, the project path is still deemed safe through make_safe_path().
Allow contrib_destination to be managed per project.
@jhedstrom - This look sane to you? This sort of file control over download location does seem to be missing from Make AFAICT.
Would this, in the case of make being called with the no-core option, ignore this and place all projects in one place?
@fiasco - any comment?
I tested this with the following Drush make file called build.make:
api = 2
core = 7.x
projects = drupal
projects[views][subdir] = "contrib"
projects[ctools][contrib_destination] = "sites/default"
projects[rules][contrib_destination] = "profiles/standard"
First running drush make build.make in an empty directory it downloaded drupal in the root folder and installed all the modules in the correct locations (creating directories as needed). Then running drush make --no-core build.make, the command continued to work as expected and downloaded the projects again to the correct directories:
drush make build.make
drush make --no-core build.make
➜ /tmp/drush-test find . -name views.module
➜ /tmp/drush-test find . -name rules.module
➜ /tmp/drush-test find . -name ctools.module
Thanks for running those tests. I've tested locally as well and drush make behaves as expected with the --no-core flag.