user permission bug