bug in group permission check