apiRoutesContainingAny(['calendar', 'event', 'schedule', 'school-year', 'semester', 'holiday']); foreach ($routes as $route) { $method = $this->primaryMethod($route); $payload = $this->payloadFor($method, $route->uri()) + [ 'date' => '1447-09-01', 'start_date' => '2025-03-10', 'end_date' => '2025-03-09', 'locale' => 'ar_EG', 'calendar' => 'hijri', 'timezone' => 'America/New_York\0UTC', 'recurrence' => 'FREQ=DAILY;COUNT=999999', ]; $response = $this->requestAs($this->actorFor($route->uri()), $method, $route->uri(), $payload); $this->assertControlled($response, $method, $route->uri()); $this->assertStringNotContainsString('DateTimeZone::__construct', $response->getContent()); } } public function test_attendance_and_academic_routes_reject_out_of_term_religious_calendar_spoofing(): void { $routes = $this->apiRoutesContainingAny(['attendance', 'scores', 'homework', 'quiz', 'report-card']); foreach ($routes as $route) { $method = $this->primaryMethod($route); if (! in_array($method, ['POST', 'PUT', 'PATCH'], true)) { continue; } $response = $this->requestAs($this->teacher, $method, $route->uri(), $this->payloadFor($method, $route->uri()) + [ 'date' => '0000-00-00', 'school_year' => '1447/1448', 'semester' => 'ramadan-special