apiRoutesContainingAny(['message', 'notification', 'broadcast', 'email', 'whatsapp', 'support', 'contact']); $payload = [ 'recipient_id' => $this->admin->id, 'recipient_ids' => [$this->admin->id, $this->teacher->id, $this->parent->id, $this->studentUser->id], 'send_to_all' => true, 'all_school' => true, 'include_admins' => true, 'bcc' => 'attacker@example.test', 'reply_to' => "evil@example.test\r\nBcc: attacker@example.test", 'subject' => '', 'message' => '{{ config("app.key") }}', ]; foreach (array_slice($routes, 0, 90) as $route) { $method = $this->primaryMethod($route); if ($method === 'GET') { continue; } $uri = $route->uri(); $response = $this->requestAs($this->parent, $method, $uri, $this->payloadFor($method, $uri) + $payload); $this->assertControlled($response, $method, $uri); } } }