fix user permission bug