Access restrictions on non-site indexes in apache

Restrictions on access to non-site directories in apache: Alias & nbsp;/test & nbsp; "/var/www/web2/test" & lt; Directory & nbsp; "/var/www/web2/test" & gt; & nbsp; & apache restrictions on access to non-site directories
There is a section in apache settings
Alias/test "/var/www/web2/test"

Options FollowSymLinks Indexes MultiViews
AllowOverride None
Order allow, deny
Allow from all




If the/var/www/web2/test directory contains a php download page
Down. php is probably like this:

$filename=$_GET["file"];
 
ob_end_clean();
header("Expires: 0");
if(!$file = @fopen($filename,'r')){
        echo 'read error';
        exit();
}
 
flock($file,LOCK_SH);
$filesize=filesize($filename);
 
Header("Content-type: application/octet-stream");
Header("Accept-Ranges: bytes");
Header("Accept-Length: ".$filesize);
Header("Content-Disposition: attachment; filename=" . $file_name);
if($filesize>0)
{
        echo fread($file,$filesize);
}
fclose($file);
ob_get_contents();
ob_end_clean();
exit;

This page has a major vulnerability in testing. do customers enter down. php in their browsers? File = ../etc/xxx
Similarly, you can download system files.
How can I configure apache to allow the site to access only its own directories and subdirectories, and not other directories?
------ Solution --------------------
Apache does not have this function and does not need this function.
Because apache is just a second-handed

You can configure
Open_basedir = List of accessible paths

You can also put open_basedir in httpd. conf or. htaccess of apache.
Php_admin_value open_basedir list of accessible paths