fix bug user permission