remove eval() + modification of permissions in manifest