public function testDirectoryTraversalProtection() { $this->get('/pages/../Layout/ajax'); $this->assertResponseCode(403); $this->assertResponseContains('Forbidden'); }