Have downloads always end up under WORKING_DIRECTORY

fixes: #5912

CHANGES/plugin_api/5912.bugfix

@@ -0,0 +1 @@
+Downloaders now always ensure the download ends up under `WORKING_DIRECTORY`.

pulpcore/download/base.py

@@ -7,6 +7,7 @@
 import tempfile
 from urllib.parse import urlsplit
 
+from django.conf import settings
 from pulpcore.app import pulp_hashlib
 from pulpcore.app.models import Artifact
 from pulpcore.exceptions import (
@@ -127,7 +128,12 @@ def _ensure_writer_has_open_file(self):
             # write the file to the current working directory with a random prefix and the
             # desired suffix. we always want the random prefix as it is possible to download
             # the same filename from two different URLs, and the files may not be the same.
-            self._writer = tempfile.NamedTemporaryFile(dir=".", suffix=suffix, delete=False)
+            work_dir = str(settings.WORKING_DIRECTORY)
+            self._writer = tempfile.NamedTemporaryFile(
+                dir="." if work_dir in os.getcwd() else work_dir,
+                suffix=suffix,
+                delete=False,
+            )
             self.path = self._writer.name
             self._digests = {n: pulp_hashlib.new(n) for n in Artifact.DIGEST_FIELDS}
             self._size = 0