fix: disable api endpoint for ffmpeg path for security (#11225)

Co-authored-by: Niels van Velzen <nielsvanvelzen@users.noreply.github.com>

1 files changed, 4 insertions, 1 deletions

diff --git a/Jellyfin.Api/Controllers/ConfigurationController.cs b/Jellyfin.Api/Controllers/ConfigurationController.cs
index 8db22f7eb..abe8bec2d 100644
--- a/Jellyfin.Api/Controllers/ConfigurationController.cs
+++ b/Jellyfin.Api/Controllers/ConfigurationController.cs
@@ -125,12 +125,15 @@ public class ConfigurationController : BaseJellyfinApiController
     /// <param name="mediaEncoderPath">Media encoder path form body.</param>
     /// <response code="204">Media encoder path updated.</response>
     /// <returns>Status.</returns>
+    [Obsolete("This endpoint is obsolete.")]
+    [ApiExplorerSettings(IgnoreApi = true)]
     [HttpPost("MediaEncoder/Path")]
     [Authorize(Policy = Policies.FirstTimeSetupOrElevated)]
     [ProducesResponseType(StatusCodes.Status204NoContent)]
     public ActionResult UpdateMediaEncoderPath([FromBody, Required] MediaEncoderPathDto mediaEncoderPath)
     {
-        _mediaEncoder.UpdateEncoderPath(mediaEncoderPath.Path, mediaEncoderPath.PathType);
+        // API ENDPOINT DISABLED (NOOP) FOR SECURITY PURPOSES
+        // _mediaEncoder.UpdateEncoderPath(mediaEncoderPath.Path, mediaEncoderPath.PathType);
         return NoContent();
     }
 }