Merge branch 'fix-public-permissions-in-display' into 'dev'

FIX: Display urls won't show to permitted remote observers

See merge request hubzilla/core!1909

1 files changed, 7 insertions, 4 deletions

diff --git a/Zotlabs/Module/Display.php b/Zotlabs/Module/Display.php
index 04aeb6d5c..2aa4f6548 100644
--- a/Zotlabs/Module/Display.php
+++ b/Zotlabs/Module/Display.php
@@ -269,17 +269,20 @@ class Display extends \Zotlabs\Web\Controller {
 					$sysid = 0;
 
 				$r = q("SELECT item.id as item_id from item
-					WHERE mid = '%s'
+					WHERE ( (mid = '%s'
 					AND (((( item.allow_cid = ''  AND item.allow_gid = '' AND item.deny_cid  = ''
 					AND item.deny_gid  = '' AND item_private = 0 )
 					and uid in ( " . stream_perms_api_uids(($observer_hash) ? (PERMS_NETWORK|PERMS_PUBLIC) : PERMS_PUBLIC) . " ))
-					OR uid = %d )
-					$sql_extra )
+					OR uid = %d ) ) ) OR
+					(mid = '%s' $sql_extra ) )
 					$item_normal
 					limit 1",
 					dbesc($target_item['parent_mid']),
-					intval($sysid)
+					intval($sysid),
+					dbesc($target_item['parent_mid'])
 				);
+
+
 			}
 		}