fix permission problem
add box file url