fix a error for boxes module about permissions