[TYPO3-ect] Custom templates for php-engine

[André Spindler]

Hello!

I'm writing an extension with online creation of invoices in html an then
converting them to pdf. That works fine fine.
I consequently use the mvc-framework and now have a question about using
custom templates.
There is a "default"-template in the folder "templates" of my extension. But
there should be the possibility to create custom invoices (with logo,
headers and so on, following corporate idendity). When using the
php-template-engine, these files have to be php-files. But it is not
possible to upload php-files via TCEforms by default. And if I save them as
invoice-template.txt or invoice.tmpl, the template-engine is adding the
suffix ".php", as it only checks for the ending and not the existence of the
file.
I think for security reasons uploads of ".php"-files shouldn't be allowed.
but what about checking of the existence of the template-file in
"tx_lib_phpTemplateEngine"/"render"?

Greetings,
André Spindler