fix: review round 2 — geocode 0-coord, tel: sanitization, Factory ACL

- Fix geocoding trigger: use isset+is_numeric instead of !empty for
  coordinate detection (same 0.0 bug pattern as Haversine fix)
- Sanitize tel: href to digits/+/-/() only (prevents URI injection)
- Use Factory::getApplication() for ACL check (consistent with codebase)

Authored-by: Moko Consulting

source/packages/com_mokosuitestorelocator/admin/src/Controller/ImportController.php

@@ -10,6 +10,7 @@ namespace Moko\Component\MokoSuiteStoreLocator\Administrator\Controller;
 
 defined('_JEXEC') or die;
 
+use Joomla\CMS\Factory;
 use Joomla\CMS\Language\Text;
 use Joomla\CMS\MVC\Controller\BaseController;
 use Joomla\CMS\Router\Route;
@@ -34,7 +35,7 @@ class ImportController extends BaseController
 		Session::checkToken() or jexit(Text::_('JINVALID_TOKEN'));
 
 		// ACL check — user must have create permission
-		if (!$this->app->getIdentity()->authorise('core.create', 'com_mokosuitestorelocator'))
+		if (!Factory::getApplication()->getIdentity()->authorise('core.create', 'com_mokosuitestorelocator'))
 		{
 			$this->setMessage(Text::_('JLIB_APPLICATION_ERROR_CREATE_RECORD_NOT_PERMITTED'), 'error');
 			$this->setRedirect(Route::_('index.php?option=com_mokosuitestorelocator&view=locations', false));

source/packages/com_mokosuitestorelocator/admin/src/Model/LocationModel.php

@@ -99,7 +99,8 @@ class LocationModel extends AdminModel
 	 */
 	public function save($data)
 	{
-		$hasCoords = !empty($data['latitude']) && !empty($data['longitude']);
+		$hasCoords = isset($data['latitude'], $data['longitude'])
+			&& is_numeric($data['latitude']) && is_numeric($data['longitude']);
 		$hasAddress = !empty($data['address']) || !empty($data['city']) || !empty($data['postcode']);
 
 		if (!$hasCoords && $hasAddress)

source/packages/com_mokosuitestorelocator/site/tmpl/location/default.php

@@ -71,7 +71,8 @@ $item = $this->item;
 			<?php if ($item->phone) : ?>
 				<div>
 					<strong><?php echo Text::_('COM_MOKOJOOMSTORELOCATOR_FIELD_PHONE'); ?>:</strong>
-					<a href="tel:<?php echo $this->escape($item->phone); ?>" itemprop="telephone">
+					<?php $safePhone = preg_replace('/[^0-9+\-() ]/', '', $item->phone); ?>
+					<a href="tel:<?php echo $this->escape($safePhone); ?>" itemprop="telephone">
 						<?php echo $this->escape($item->phone); ?>
 					</a>
 				</div>

source/packages/com_mokosuitestorelocator/site/tmpl/locations/default.php

@@ -54,7 +54,8 @@ use Joomla\CMS\Router\Route;
 
 						<?php if ($item->phone) : ?>
 							<div class="com-mokosuitestorelocator-location-card__phone">
-								<a href="tel:<?php echo $this->escape($item->phone); ?>" itemprop="telephone">
+								<?php $safePhone = preg_replace('/[^0-9+\-() ]/', '', $item->phone); ?>
+								<a href="tel:<?php echo $this->escape($safePhone); ?>" itemprop="telephone">
 									<?php echo $this->escape($item->phone); ?>
 								</a>
 							</div>