diff --git a/packages/hydrooj/package.json b/packages/hydrooj/package.json
index 3a79e2926..8c575a370 100644
--- a/packages/hydrooj/package.json
+++ b/packages/hydrooj/package.json
@@ -1,6 +1,6 @@
 {
     "name": "hydrooj",
-    "version": "2.13.37",
+    "version": "2.13.38",
     "bin": "bin/hydrooj.js",
     "main": "dist/loader.js",
     "typings": "dist/loader.d.ts",
diff --git a/packages/hydrooj/src/handler/domain.ts b/packages/hydrooj/src/handler/domain.ts
index bb2a9b97d..ab1da0829 100644
--- a/packages/hydrooj/src/handler/domain.ts
+++ b/packages/hydrooj/src/handler/domain.ts
@@ -126,10 +126,7 @@ class DomainPermissionHandler extends ManageHandler {
         const roles = await domain.getRoles(domainId);
         const log2 = (val: bigint) => {
             // @ts-ignore
-            for (let i = 0n; ; i++) {
-                // @ts-ignore
-                if ((val >> i) === 0n) return parseInt(i.toString(), 10) - 1;
-            }
+            for (let i = 0n; ; i++) if (!(val >> i)) return +i.toString() - 1;
         };
         const path = [
             ['Hydro', 'homepage'],
@@ -144,14 +141,16 @@ class DomainPermissionHandler extends ManageHandler {
 
     async post({ domainId }) {
         const roles = {};
+        delete this.request.body.csrfToken;
         for (const role in this.request.body) {
-            if (this.request.body[role] instanceof Array) {
-                const perms = this.request.body[role];
-                // @ts-ignore
-                roles[role] = 0n;
-                // @ts-ignore
-                for (const r of perms) roles[role] += 1n << BigInt(r);
-            }
+            const perms = this.request.body[role] instanceof Array
+                ? this.request.body[role]
+                : [this.request.body[role]];
+            // @ts-ignore
+            roles[role] = 0n;
+            console.log(role, perms);
+            // @ts-ignore
+            for (const r of perms) roles[role] += 1n << BigInt(r);
         }
         await domain.setRoles(domainId, roles);
         this.back();
diff --git a/packages/hydrooj/src/model/builtin.ts b/packages/hydrooj/src/model/builtin.ts
index 8ebd0ed11..958bf3d69 100644
--- a/packages/hydrooj/src/model/builtin.ts
+++ b/packages/hydrooj/src/model/builtin.ts
@@ -45,7 +45,7 @@ export const PERM = {
     PERM_VIEW_DISCUSSION: 1n << 27n,
     PERM_CREATE_DISCUSSION: 1n << 28n,
     PERM_HIGHLIGHT_DISCUSSION: 1n << 29n,
-    PERM_PIN_DISCUSSION: 1n << 59n,
+    PERM_PIN_DISCUSSION: 1n << 61n,
     PERM_EDIT_DISCUSSION: 1n << 30n,
     PERM_EDIT_DISCUSSION_SELF: 1n << 31n,
     PERM_DELETE_DISCUSSION: 1n << 32n,
@@ -81,7 +81,7 @@ export const PERM = {
     PERM_EDIT_TRAINING_SELF: 1n << 49n,
 
     // Ranking
-    PERM_VIEW_RANKING: 1n << 50n,
+    PERM_VIEW_RANKING: 1n << 59n,
 
     // Placeholder
     PERM_ALL: -1n,
@@ -89,7 +89,7 @@ export const PERM = {
     PERM_DEFAULT: 0n,
     PERM_ADMIN: -1n,
 
-    PERM_NEVER: 1n << 59n,
+    PERM_NEVER: 1n << 60n,
 };
 
 export const Permission = (family: string, key: BigInt, desc: string) => ({ family, key, desc });