restrict priviledge
fix variable scope