fix ensurePermission to get file path from params[0] or body