Fix: best way, use controller for check user and group rights