diff --git a/backend/src/main/java/io/dataease/controller/dataset/DataSetTableController.java b/backend/src/main/java/io/dataease/controller/dataset/DataSetTableController.java
index b42ff15fb9..7b68637c97 100644
--- a/backend/src/main/java/io/dataease/controller/dataset/DataSetTableController.java
+++ b/backend/src/main/java/io/dataease/controller/dataset/DataSetTableController.java
@@ -49,7 +49,8 @@ public class DataSetTableController {
 
     @DePermissions(value = {
             @DePermission(type = DePermissionType.DATASET, value = "id", level = ResourceAuthLevel.DATASET_LEVEL_MANAGE),
-            @DePermission(type = DePermissionType.DATASET, value = "sceneId", level = ResourceAuthLevel.DATASET_LEVEL_MANAGE)
+            @DePermission(type = DePermissionType.DATASET, value = "sceneId", level = ResourceAuthLevel.DATASET_LEVEL_MANAGE),
+            @DePermission(type = DePermissionType.DATASOURCE, value = "dataSourceId", level = ResourceAuthLevel.DATASOURCE_LEVEL_USE)
     }, logical = Logical.AND)
     @ApiOperation("更新")
     @PostMapping("update")
@@ -135,6 +136,10 @@ public class DataSetTableController {
 
     @ApiOperation("根据sql查询预览数据")
     @PostMapping("sqlPreview")
+    @DePermissions(value = {
+            @DePermission(type = DePermissionType.DATASET, value = "id", level = ResourceAuthLevel.DATASET_LEVEL_USE),
+            @DePermission(type = DePermissionType.DATASOURCE, value = "dataSourceId", level = ResourceAuthLevel.DATASOURCE_LEVEL_USE)
+    }, logical = Logical.AND)
     public Map<String, Object> getSQLPreview(@RequestBody DataSetTableRequest dataSetTableRequest) throws Exception {
         return dataSetTableService.getSQLPreview(dataSetTableRequest);
     }
diff --git a/backend/src/main/java/io/dataease/controller/sys/SysPluginController.java b/backend/src/main/java/io/dataease/controller/sys/SysPluginController.java
index b0b3d38139..ca0fe4e144 100644
--- a/backend/src/main/java/io/dataease/controller/sys/SysPluginController.java
+++ b/backend/src/main/java/io/dataease/controller/sys/SysPluginController.java
@@ -10,6 +10,7 @@ import io.dataease.controller.sys.request.PluginStatus;
 import io.dataease.service.sys.PluginService;
 import io.swagger.annotations.Api;
 import io.swagger.annotations.ApiOperation;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.*;
 import org.springframework.web.multipart.MultipartFile;
@@ -29,6 +30,7 @@ public class SysPluginController {
 
     @ApiOperation("查询已安装插件")
     @PostMapping("/pluginGrid/{goPage}/{pageSize}")
+    @RequiresPermissions("plugin:read")
     public Pager<List<MyPlugin>> pluginGrid(@PathVariable int goPage, @PathVariable int pageSize, @RequestBody BaseGridRequest request) {
         Page<Object> page = PageHelper.startPage(goPage, pageSize, true);
         return PageUtils.setPageInfo(page, pluginService.query(request));
@@ -36,19 +38,21 @@ public class SysPluginController {
 
     @ApiOperation("安装插件")
     @PostMapping("upload")
+    @RequiresPermissions("plugin:upload")
     public Map<String, Object> localUpload(@RequestParam("file") MultipartFile file) throws Exception {
         return pluginService.localInstall(file);
     }
 
     @ApiOperation("卸载插件")
     @PostMapping("/uninstall/{pluginId}")
+    @RequiresPermissions("plugin:uninstall")
     public Boolean unInstall(@PathVariable Long pluginId) {
         return pluginService.uninstall(pluginId);
     }
 
-    @ApiOperation("切换插件状态")
-    @PostMapping("/changeStatus")
-    public Boolean changeStatus(@RequestBody PluginStatus pluginStatus) {
-        return pluginService.changeStatus(pluginStatus.getPluginId(), pluginStatus.getStatus());
-    }
+//    @ApiOperation("切换插件状态")
+//    @PostMapping("/changeStatus")
+//    public Boolean changeStatus(@RequestBody PluginStatus pluginStatus) {
+//        return pluginService.changeStatus(pluginStatus.getPluginId(), pluginStatus.getStatus());
+//    }
 }
diff --git a/backend/src/main/resources/db/migration/V36__1.11.2.sql b/backend/src/main/resources/db/migration/V36__1.11.2.sql
new file mode 100644
index 0000000000..24d11e7eeb
--- /dev/null
+++ b/backend/src/main/resources/db/migration/V36__1.11.2.sql
@@ -0,0 +1,2 @@
+INSERT INTO `sys_menu` (`menu_id`, `pid`, `sub_count`, `type`, `title`, `name`, `component`, `menu_sort`, `icon`, `path`, `i_frame`, `cache`, `hidden`, `permission`, `create_by`, `update_by`, `create_time`, `update_time`) VALUES (102, 101, 0, 2, '上传插件', NULL, NULL, 999, NULL, NULL, b'0', b'0', b'0', 'plugin:upload', NULL, NULL, 1614930862373, 1614930862373);
+INSERT INTO `sys_menu` (`menu_id`, `pid`, `sub_count`, `type`, `title`, `name`, `component`, `menu_sort`, `icon`, `path`, `i_frame`, `cache`, `hidden`, `permission`, `create_by`, `update_by`, `create_time`, `update_time`) VALUES (103, 101, 0, 2, '卸载插件', NULL, NULL, 999, NULL, NULL, b'0', b'0', b'0', 'plugin:uninstall', NULL, NULL, 1614930862373, 1614930862373);
diff --git a/frontend/src/views/dataset/add/union/NodeItem.vue b/frontend/src/views/dataset/add/union/NodeItem.vue
index e5857135f6..17e8e12313 100644
--- a/frontend/src/views/dataset/add/union/NodeItem.vue
+++ b/frontend/src/views/dataset/add/union/NodeItem.vue
@@ -4,6 +4,7 @@
       <svg-icon v-if="currentNode.currentDs.modelInnerType === 'db'" icon-class="ds-db" class="ds-icon-db" />
       <svg-icon v-else-if="currentNode.currentDs.modelInnerType === 'sql'" icon-class="ds-sql" class="ds-icon-sql" />
       <svg-icon v-else-if="currentNode.currentDs.modelInnerType === 'excel'" icon-class="ds-excel" class="ds-icon-excel" />
+      <svg-icon v-else-if="currentNode.currentDs.modelInnerType === 'api'" icon-class="ds-api" class="ds-icon-api" />
 
       <span class="node-name" :title="currentNode.currentDs.name">{{ currentNode.currentDs.name }}</span>
 
diff --git a/frontend/src/views/system/plugin/index.vue b/frontend/src/views/system/plugin/index.vue
index 59276e27c5..794e8bde69 100644
--- a/frontend/src/views/system/plugin/index.vue
+++ b/frontend/src/views/system/plugin/index.vue
@@ -9,6 +9,7 @@
     >
       <template #toolbar>
         <el-upload
+          v-permission="['plugin:upload']"
           :action="baseUrl+'api/plugin/upload'"
           :multiple="false"
           :show-file-list="false"
@@ -54,7 +55,7 @@
 import LayoutContent from '@/components/business/LayoutContent'
 import ComplexTable from '@/components/business/complex-table'
 
-// import { checkPermission } from '@/utils/permission'
+import { checkPermission } from '@/utils/permission'
 import { formatCondition, formatQuickCondition } from '@/utils/index'
 import { pluginLists, uninstall } from '@/api/system/plugin'
 import { getToken } from '@/utils/auth'
@@ -72,6 +73,7 @@ export default {
         // }
         {
           label: this.$t('plugin.un_install'), icon: 'el-icon-delete', type: 'danger', click: this.del,
+          show: checkPermission(['plugin:uninstall']),
           disabled: this.btnDisabled
         }
       ],