diff --git a/apps/jumpserver/urls.py b/apps/jumpserver/urls.py
index ced4797d5..e98d17dbc 100644
--- a/apps/jumpserver/urls.py
+++ b/apps/jumpserver/urls.py
@@ -36,9 +36,11 @@ urlpatterns = [
     url(r'^captcha/', include('captcha.urls')),
 ]
 
+urlpatterns += static(settings.STATIC_URL, document_root=settings.STATIC_ROOT) \
+      + static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)
+
 if settings.DEBUG:
     urlpatterns += [
         url(r'^docs/', schema_view, name="docs"),
-    ] + static(settings.STATIC_URL, document_root=settings.STATIC_ROOT) \
-      + static(settings.MEDIA_URL, document_root=settings.MEDIA_ROOT)
+    ]
 
diff --git a/apps/terminal/api.py b/apps/terminal/api.py
index 8247ac27c..e625e17bc 100644
--- a/apps/terminal/api.py
+++ b/apps/terminal/api.py
@@ -248,7 +248,7 @@ class CommandViewSet(viewsets.ViewSet):
 
 class SessionReplayViewSet(viewsets.ViewSet):
     serializer_class = ReplaySerializer
-    permission_classes = ()
+    permission_classes = (IsSuperUserOrAppUser,)
     session = None
 
     def gen_session_path(self):