diff --git a/app/Http/Controllers/Modules/Item.php b/app/Http/Controllers/Modules/Item.php
index f5d55340b..a7b404a5f 100644
--- a/app/Http/Controllers/Modules/Item.php
+++ b/app/Http/Controllers/Modules/Item.php
@@ -2,19 +2,33 @@
 
 namespace App\Http\Controllers\Modules;
 
-use Illuminate\Http\Request;
-
 use App\Http\Controllers\Controller;
 use App\Models\Module\Module;
 use App\Models\Module\ModuleHistory;
 use App\Traits\Modules;
 use Artisan;
+use Illuminate\Http\Request;
 use Illuminate\Routing\Route;
 
 class Item extends Controller
 {
     use Modules;
 
+    /**
+     * Instantiate a new controller instance.
+     *
+     * @param  Route  $route
+     */
+    public function __construct(Route $route)
+    {
+        parent::__construct($route);
+
+        // Add CRUD permission check
+        $this->middleware('permission:create-modules-item')->only(['install']);
+        $this->middleware('permission:update-modules-item')->only(['update', 'enable', 'disable']);
+        $this->middleware('permission:delete-modules-item')->only(['uninstall']);
+    }
+
     /**
      * Show the form for viewing the specified resource.
      *
@@ -31,7 +45,7 @@ class Item extends Controller
 
         $module = $this->getModule($alias);
 
-        $check = Module::where('alias', $alias)->first();
+        $check = Module::alias($alias)->first();
 
         if ($check) {
             $installed = true;
@@ -154,7 +168,7 @@ class Item extends Controller
 
         $json = $this->uninstallModule($alias);
 
-        $module = Module::where('alias', $alias)->first();
+        $module = Module::alias($alias)->first();
 
         $data = array(
             'company_id' => session('company_id'),
@@ -181,7 +195,7 @@ class Item extends Controller
 
         $json = $this->updateModule($alias);
 
-        $module = Module::where('alias', $alias)->first();
+        $module = Module::alias($alias)->first();
 
         $data = array(
             'company_id' => session('company_id'),
@@ -206,7 +220,7 @@ class Item extends Controller
 
         $json = $this->enableModule($alias);
 
-        $module = Module::where('alias', $alias)->first();
+        $module = Module::alias($alias)->first();
 
         $data = array(
             'company_id' => session('company_id'),
@@ -235,7 +249,7 @@ class Item extends Controller
 
         $json = $this->disableModule($alias);
 
-        $module = Module::where('alias', $alias)->first();
+        $module = Module::alias($alias)->first();
 
         $data = array(
             'company_id' => session('company_id'),
diff --git a/app/Models/Module/Module.php b/app/Models/Module/Module.php
index 9347d0e48..34fe6cd34 100644
--- a/app/Models/Module/Module.php
+++ b/app/Models/Module/Module.php
@@ -17,4 +17,16 @@ class Module extends Model
      * @var array
      */
     protected $fillable = ['company_id', 'alias', 'status'];
+
+    /**
+     * Scope alias.
+     *
+     * @param \Illuminate\Database\Eloquent\Builder $query
+     * @param string $alias
+     * @return \Illuminate\Database\Eloquent\Builder
+     */
+    public function scopeAlias($query, $alias)
+    {
+        return $query->where('alias', $alias);
+    }
 }
diff --git a/resources/views/modules/item/show.blade.php b/resources/views/modules/item/show.blade.php
index e1fe18599..0b7e98605 100644
--- a/resources/views/modules/item/show.blade.php
+++ b/resources/views/modules/item/show.blade.php
@@ -74,13 +74,18 @@
 
                     <div class="box-footer">
                         @if ($installed)
+                            @permission('delete-modules-item')
                             <a href="{{ url('apps/' . $module->slug . '/uninstall') }}" class="btn btn-block btn-danger">{{ trans('modules.button.uninstall') }}</a>
+                            @endpermission
+                            @permission('update-modules-item')
                             @if ($enable)
                                 <a href="{{ url('apps/' . $module->slug . '/disable') }}" class="btn btn-block btn-warning">{{ trans('modules.button.disable') }}</a>
                             @else
                                 <a href="{{ url('apps/' . $module->slug . '/enable') }}" class="btn btn-block btn-success">{{ trans('modules.button.enable') }}</a>
                             @endif
+                            @endpermission
                         @else
+                            @permission('create-modules-item')
                             @if ($module->install)
                             <a href="{{ $module->action_url }}" class="btn btn-success btn-block" id="install-module">
                                 {{ trans('modules.install') }}
@@ -90,6 +95,7 @@
                                 {{ trans('modules.buy_now') }}
                             </a>
                             @endif
+                            @endpermission
                         @endif
                     </div>
                     <!-- /.box-footer -->