Fixed multiple permission in a controller