Skip to content


Subversion checkout URL

You can clone with
Download ZIP


Allow contrib_destination to be managed per project. #582

merged 1 commit into from

3 participants


When defining a Make file, you can't currently control the download contrib destination per project, only globally. This means all module projects are downloaded and restricted to something like "sites/all" by default. If you are using multisite and need to download different modules to different subdirectories, then you can't currently manage that will one drush make call. Likewise, if you want to update modules in a profile, the same issue applies.

This patch amends that be enabling contrib_destination to be controlled per project. However, the project path is still deemed safe through make_safe_path().

@jhedstrom jhedstrom was assigned by weitzman

@jhedstrom - This look sane to you? This sort of file control over download location does seem to be missing from Make AFAICT.


Would this, in the case of make being called with the no-core option, ignore this and place all projects in one place?


@fiasco - any comment?


I tested this with the following Drush make file called build.make:

api = 2
core = 7.x
projects[] = drupal

projects[views][subdir] = "contrib"
projects[ctools][contrib_destination] = "sites/default"
projects[rules][contrib_destination] = "profiles/standard"

First running drush make build.make in an empty directory it downloaded drupal in the root folder and installed all the modules in the correct locations (creating directories as needed). Then running drush make --no-core build.make, the command continued to work as expected and downloaded the projects again to the correct directories:

➜  /tmp/drush-test  find . -name views.module
➜  /tmp/drush-test  find . -name rules.module
➜  /tmp/drush-test  find . -name ctools.module
@jhedstrom jhedstrom merged commit b49e9cb into drush-ops:master

1 check passed

Details continuous-integration/travis-ci The Travis CI build passed

Thanks for running those tests. I've tested locally as well and drush make behaves as expected with the --no-core flag.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Commits on Apr 14, 2014
This page is out of date. Refresh to see the latest.
Showing with 1 addition and 5 deletions.
  1. +1 −5 commands/make/
6 commands/make/
@@ -195,13 +195,9 @@ function make_validate_info_file($info) {
$names[] = $project;
foreach ($project_data as $attribute => $value) {
- // Unset disallowed attributes.
- if (in_array($attribute, array('contrib_destination'))) {
- unset($info['projects'][$project][$attribute]);
- }
// Prevent malicious attempts to access other areas of the
// filesystem.
- elseif (in_array($attribute, array('subdir', 'directory_name')) && !make_safe_path($value)) {
+ if (in_array($attribute, array('subdir', 'directory_name', 'contrib_destination')) && !make_safe_path($value)) {
$args = array(
'!path' => $value,
'!attribute' => $attribute,
Something went wrong with that request. Please try again.