Backport pull request #12490 from jellyfin/release-10.9.z

Set Content-Disposition header to attachment for image endpoints

Original-merge: 9645955629595a6ba2668432aeeadc4989c413b2

Merged-by: crobibero <cody@robibe.ro>

Backported-by: Joshua M. Boniface <joshua@boniface.me>

Jellyfin.Api/Controllers/ImageController.cs

@@ -2089,6 +2089,8 @@ public class ImageController : BaseJellyfinApiController
         Response.Headers.Append(HeaderNames.Age, Convert.ToInt64((DateTime.UtcNow - dateImageModified).TotalSeconds).ToString(CultureInfo.InvariantCulture));
         Response.Headers.Append(HeaderNames.Vary, HeaderNames.Accept);
 
+        Response.Headers.ContentDisposition = "attachment";
+
         if (disableCaching)
         {
             Response.Headers.Append(HeaderNames.CacheControl, "no-cache, no-store, must-revalidate");

Jellyfin.Api/Controllers/PluginsController.cs

@@ -233,6 +233,8 @@ public class PluginsController : BaseJellyfinApiController
             return NotFound();
         }
 
+        Response.Headers.ContentDisposition = "attachment";
+
         imagePath = Path.Combine(plugin.Path, plugin.Manifest.ImagePath);
         return PhysicalFile(imagePath, MimeTypes.GetMimeType(imagePath));
     }

Jellyfin.Api/Controllers/TrickplayController.cs

@@ -95,6 +95,7 @@ public class TrickplayController : BaseJellyfinApiController
         var path = _trickplayManager.GetTrickplayTilePath(item, width, index);
         if (System.IO.File.Exists(path))
         {
+            Response.Headers.ContentDisposition = "attachment";
             return PhysicalFile(path, MediaTypeNames.Image.Jpeg);
         }