diff --git a/apps/assets/signals_handler.py b/apps/assets/signals_handler.py
index 9e6eb21eb..63dc3e882 100644
--- a/apps/assets/signals_handler.py
+++ b/apps/assets/signals_handler.py
@@ -37,7 +37,7 @@ def push_cluster_system_users_to_asset(asset):
 @receiver(post_save, sender=Asset, dispatch_uid="my_unique_identifier")
 def on_asset_created(sender, instance=None, created=False, **kwargs):
     if instance and created:
-        logger.info("Asset `` create signal received".format(instance))
+        logger.info("Asset `{}` create signal received".format(instance))
         update_asset_hardware_info_on_created(instance)
         test_asset_conn_on_created(instance)
         push_cluster_system_users_to_asset(instance)
diff --git a/apps/assets/templates/assets/asset_group_detail.html b/apps/assets/templates/assets/asset_group_detail.html
index 9a691036b..4a9b719b1 100644
--- a/apps/assets/templates/assets/asset_group_detail.html
+++ b/apps/assets/templates/assets/asset_group_detail.html
@@ -17,6 +17,11 @@
                             <li class="pull-right">
                                 <a class="btn btn-outline btn-default" href="{% url 'assets:asset-group-update' pk=asset_group.id %}"><i class="fa fa-edit"></i>{% trans 'Update' %}</a>
                             </li>
+                            <li class="pull-right">
+                                <a class="btn btn-outline btn-danger btn-del">
+                                    <i class="fa fa-trash-o"></i>{% trans 'Delete' %}
+                                </a>
+                            </li>
                         </ul>
                     </div>
                     <div class="tab-content">
@@ -212,7 +217,6 @@ $(document).ready(function () {
   addAssets(assets_id);
 })
 
-
 .on('click', '.btn-leave-group', function () {
 	var $this = $(this);
 	var the_url = "{% url 'api-assets:group-update-assets' pk=asset_group.id %}";
@@ -225,6 +229,13 @@ $(document).ready(function () {
 	assets.remove(delete_asset_id);
 	var data = {"assets": assets};
 	leaveGroup($this, name, the_url, data);
+}).on('click', '.btn-del', function () {
+    var $this = $(this);
+    var name = "{{ asset_group.name}}";
+    var uid = "{{ asset_group.id }}";
+    var the_url = '{% url "api-assets:asset-group-detail" pk=DEFAULT_PK %}'.replace('{{ DEFAULT_PK }}', uid);
+    var redirect_url = "{% url 'assets:asset-group-list' %}";
+    objectDelete($this, name, the_url, redirect_url);
 })
 
 
diff --git a/apps/assets/templates/assets/system_user_detail.html b/apps/assets/templates/assets/system_user_detail.html
index db9cf9670..0bf591bb2 100644
--- a/apps/assets/templates/assets/system_user_detail.html
+++ b/apps/assets/templates/assets/system_user_detail.html
@@ -25,6 +25,11 @@
                             <li class="pull-right">
                                 <a class="btn btn-outline btn-default" href="{% url 'assets:system-user-update' pk=system_user.id %}"><i class="fa fa-edit"></i>{% trans 'Update' %}</a>
                             </li>
+                            <li class="pull-right">
+                                <a class="btn btn-outline btn-danger btn-del">
+                                    <i class="fa fa-trash-o"></i>{% trans 'Delete' %}
+                                </a>
+                            </li>
                         </ul>
                     </div>
                     <div class="tab-content">
@@ -259,6 +264,13 @@ $(document).ready(function () {
         return $(this).data('gid');
     }).get();
     updateSystemUserCluster(clusters);
+}).on('click', '.btn-del', function () {
+    var $this = $(this);
+    var name = "{{ system_user.name}}";
+    var uid = "{{ system_user.id }}";
+    var the_url = '{% url "api-assets:system-user-detail" pk=DEFAULT_PK %}'.replace('{{ DEFAULT_PK }}', uid);
+    var redirect_url = "{% url 'assets:system-user-list' %}";
+    objectDelete($this, name, the_url, redirect_url);
 })
 </script>
 {% endblock %}
diff --git a/apps/perms/templates/perms/asset_permission_detail.html b/apps/perms/templates/perms/asset_permission_detail.html
index 942013852..5540ca515 100644
--- a/apps/perms/templates/perms/asset_permission_detail.html
+++ b/apps/perms/templates/perms/asset_permission_detail.html
@@ -237,6 +237,16 @@ $(document).ready(function () {
     }).get();
     updateSystemUser(system_users);
     $tr.remove()
+}).on('click', '#is_active', function () {
+    var the_url = '{% url "api-perms:asset-permission-detail" pk=asset_permission.id %}';
+    var checked = $(this).prop('checked');
+    var body = {
+        'is_active': checked
+    };
+    APIUpdateAttr({
+        url: the_url,
+        body: JSON.stringify(body),
+    });
 })
 </script>
 {% endblock %}
diff --git a/apps/users/api.py b/apps/users/api.py
index e1d38f572..326f2c3ec 100644
--- a/apps/users/api.py
+++ b/apps/users/api.py
@@ -128,7 +128,7 @@ class UserAuthApi(APIView):
         user_agent = request.data.get('HTTP_USER_AGENT', '')
 
         if not login_ip:
-            login_ip = request.META.get('HTTP_X_REAL_IP') or request.META.get("REMOTE_ADDR")
+            login_ip = request.META.get('HTTP_X_FORWARDED_FOR') or request.META.get("REMOTE_ADDR")
 
         user, msg = check_user_valid(
             username=username, password=password,
diff --git a/apps/users/forms.py b/apps/users/forms.py
index c27bd4378..651df78d3 100644
--- a/apps/users/forms.py
+++ b/apps/users/forms.py
@@ -46,7 +46,7 @@ class UserCreateUpdateForm(forms.ModelForm):
         }
 
     def save(self, commit=True):
-        password = self.cleaned_data.pop('password')
+        password = self.cleaned_data.get('password')
         user = super().save(commit=commit)
         if password:
             user.set_password(password)
diff --git a/apps/users/views/login.py b/apps/users/views/login.py
index fabc39b7d..493e4936c 100644
--- a/apps/users/views/login.py
+++ b/apps/users/views/login.py
@@ -53,7 +53,8 @@ class UserLoginView(FormView):
         if not self.request.session.test_cookie_worked():
             return HttpResponse(_("Please enable cookies and try again."))
         auth_login(self.request, form.get_user())
-        login_ip = self.request.META.get('REMOTE_ADDR', '')
+        login_ip = self.request.META.get('HTTP_X_FORWARDED_FOR') or \
+                   self.request.META.get('REMOTE_ADDR', '')
         user_agent = self.request.META.get('HTTP_USER_AGENT', '')
         write_login_log_async.delay(
             self.request.user.username, type='W',