fixed user permission in cms