From e46b2907f2d1838d449e0f5354941ac229668c3f Mon Sep 17 00:00:00 2001
From: Eduard Wisch <eddy@alles-watt-laeuft.de>
Date: Fri, 17 Apr 2026 12:56:16 +0200
Subject: [PATCH] =?UTF-8?q?API:=20Content-Disposition:attachment=20Header?=
 =?UTF-8?q?=20f=C3=BCr=20Download-Parameter?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 api/photo.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/api/photo.php b/api/photo.php
index 054901d..e8ddb75 100644
--- a/api/photo.php
+++ b/api/photo.php
@@ -106,10 +106,15 @@ if ($size === 'small' || $size === 'mini') {
 }
 
 $mime = function_exists('dol_mimetype') ? dol_mimetype($full) : 'application/octet-stream';
+$download = !empty($_GET['download']);
+$filename = $download ? basename($full) : '';
 
 header('Content-Type: '.$mime);
 header('Content-Length: '.filesize($full));
 header('Cache-Control: private, max-age=3600');
 header('Access-Control-Allow-Origin: *');
+if ($download) {
+    header('Content-Disposition: attachment; filename="'.addslashes($filename).'"');
+}
 readfile($full);
 exit;