class ProjectSpendProfileExportController {

    @PreAuthorize("hasPermission(#projectId, 'org.innovateuk.ifs.project.resource.ProjectCompositeId', 'ACCESS_SPEND_PROFILE_SECTION')")
    @GetMapping("/csv")
    public void exportProjectPartnerSpendProfileAsCSV(@P("projectId")@PathVariable("projectId") final Long projectId,
                                                      @PathVariable("organisationId") final Long organisationId,
                                                      UserResource loggedInUser,
                                                      HttpServletResponse response) throws IOException {
        SpendProfileCSVResource spendProfileCSVResource = spendProfileService.getSpendProfileCSV(projectId, organisationId);
        response.setContentType(CONTENT_TYPE);

        /*
         * Prevent 'HTTP response splitting attack' by removing comma from the 'Content-disposition' header.
         * If there is a comma in the 'Content-disposition' header, then it results in two values of the same 'Content-disposition' header,
         * which in turn is interpreted as a 'HTTP response splitting attack', because there cannot be "multiple Content-Disposition header" values
         * in a single HTTP response.
         *
         */
        response.setHeader(HEADER_CONTENT_DISPOSITION, getCSVAttachmentHeader(removeComma(spendProfileCSVResource.getFileName())));
        response.getOutputStream().print(spendProfileCSVResource.getCsvData());
        response.getOutputStream().flush();
    }

}