fixed user rights in dashboardlists