fixed allow/deny bug