fix acl query