//  [java]
    public void processRequest() throws Exception {
        String dir = SQLInitServlet.getField("filePath") + "crf" + File.separator + "new" + File.separator;
        // YW 09-10-2007 << Now CRF_Design_Template_v2.xls is located at
        // $CATALINA_HOME/webapps/OpenClinica-instanceName/properties
        FormProcessor fp = new FormProcessor(request);

        String crfIdString = fp.getString(CRF_ID);
        int crfVersionId = fp.getInt(CRF_VERSION_ID);

        CRFVersionDAO cvdao = new CRFVersionDAO(sm.getDataSource());

        CRFVersionBean version = (CRFVersionBean) cvdao.findByPK(crfVersionId);

        boolean isTemplate = fp.getBoolean("template");

        String excelFileName = FilenameUtils.getName(crfIdString + version.getOid() + ".xls");

        // aha, what if it's the old style? next line is for backwards compat,
        // tbh 07/2008
        File excelFile = null;
        String oldExcelFileName = FilenameUtils.getName(crfIdString + version.getName() + ".xls");
        if (isTemplate) {
            // excelFile = new File(dir + CRF_VERSION_TEMPLATE);
            excelFile = getCoreResources().getFile(CRF_VERSION_TEMPLATE, "crf" + File.separator + "original" + File.separator);
            excelFileName = CRF_VERSION_TEMPLATE;
            // FileOutputStream fos = new FileOutputStream(excelFile);
            // IOUtils.copy(getCoreResources().getInputStream(CRF_VERSION_TEMPLATE), fos);
            // IOUtils.closeQuietly(fos);
        } else {
        	// fix path traversal issue
            excelFile = new File(dir,excelFileName);
            // backwards compat
            File oldExcelFile = new File(dir, oldExcelFileName);            
            
            String canonicalPath1= excelFile.getCanonicalPath();
            String canonicalPath2= oldExcelFile.getCanonicalPath();
            if (canonicalPath1.startsWith(dir) && canonicalPath2.startsWith(dir)) {
            	if (oldExcelFile.exists() && oldExcelFile.length() > 0) {
                    if (!excelFile.exists() || excelFile.length() <= 0) {
                        // if the old name exists and the new name does not...
                        excelFile = oldExcelFile;
                        excelFileName = oldExcelFileName;
                    }
                }     
            }else {
            	 addPageMessage(respage.getString("the_excel_is_not_available_on_server_contact"));
                 forwardPage(Page.CRF_LIST_SERVLET);
            }
        	             

        }
        logger.info("looking for : " + excelFile.getName());
        if (!excelFile.exists() || excelFile.length() <= 0) {
            addPageMessage(respage.getString("the_excel_is_not_available_on_server_contact"));
            forwardPage(Page.CRF_LIST_SERVLET);
        } else {
            response.setHeader("Content-disposition", "attachment; filename=\"" + excelFileName + "\";");
            response.setContentType("application/vnd.ms-excel");
            response.setHeader("Pragma", "public");

            ServletOutputStream op = response.getOutputStream();
            DataInputStream in = null;
            try {
                response.setContentType("application/vnd.ms-excel");
                response.setHeader("Pragma", "public");
                response.setContentLength((int) excelFile.length());

                byte[] bbuf = new byte[(int) excelFile.length()];
                in = new DataInputStream(new FileInputStream(excelFile));
                int length;
                while ((in != null) && ((length = in.read(bbuf)) != -1)) {
                    op.write(bbuf, 0, length);
                }

                in.close();
                op.flush();
                op.close();
            } catch (Exception ee) {
                ee.printStackTrace();
            } finally {
                if (in != null) {
                    in.close();
                }
                if (op != null) {
                    op.close();
                }
            }
        }

    }