fixed controller permission