diff --git a/seahub/api2/views.py b/seahub/api2/views.py
index 071b3fc508..fd8e0b8954 100644
--- a/seahub/api2/views.py
+++ b/seahub/api2/views.py
@@ -3119,7 +3119,7 @@ class GroupRepos(APIView):
             "mtime": repo.last_modified,
             "mtime_relative": translate_seahub_time(repo.last_modified),
             "encrypted": repo.encrypted,
-            "permission": 'rw',  # Always have read-write permission to owned repo
+            "permission": permission,
             "owner": username,
             "owner_nickname": email2nickname(username),
             "share_from_me": True,
@@ -3136,6 +3136,7 @@ class GroupRepos(APIView):
         else:
             repos = seafile_api.get_repos_by_group(group.id)
 
+        repos.sort(lambda x, y: cmp(y.last_modified, x.last_modified))
         group.is_staff = is_group_staff(group, request.user)
 
         repos_json = []
diff --git a/tests/api/test_group_repos.py b/tests/api/test_group_repos.py
index 7cd9a14467..afe3a431ed 100644
--- a/tests/api/test_group_repos.py
+++ b/tests/api/test_group_repos.py
@@ -1,3 +1,4 @@
+import time
 from django.core.urlresolvers import reverse
 
 from tests.api.apitestbase import ApiTestBase
@@ -15,7 +16,7 @@ class GroupRepoTest(ApiTestBase):
 
     def test_can_add(self):
         with self.get_tmp_group() as group:
-            resp = self.create_group_repo(group.group_id)
+            resp = self.create_group_repo(group.group_id, permission='rw')
 
             assert resp.status_code == 200
             resp_json = resp.json()
@@ -26,6 +27,14 @@ class GroupRepoTest(ApiTestBase):
             assert resp_json['permission'] == 'rw'
             assert '</time>' in resp_json['mtime_relative']
 
+    def test_can_add_read_only(self):
+        with self.get_tmp_group() as group:
+            resp = self.create_group_repo(group.group_id, permission='r')
+
+            assert resp.status_code == 200
+            resp_json = resp.json()
+            assert resp_json['permission'] == 'r'
+
     def test_add_with_wrong_perm(self):
         with self.get_tmp_group() as group:
             resp = self.create_group_repo(group.group_id, permission='rr')
@@ -50,6 +59,23 @@ class GroupRepoTest(ApiTestBase):
             assert resp_repo['permission'] in ('r', 'rw')
             assert '</time>' in resp_repo['mtime_relative']
 
+    def test_order_by_mtime(self):
+        with self.get_tmp_group() as group:
+            self.create_group_repo(group.group_id)
+            time.sleep(1)
+            self.create_group_repo(group.group_id)
+            time.sleep(1)
+            self.create_group_repo(group.group_id)
+
+            path = apiurl(reverse("api2-grouprepos", args=[group.group_id]))
+            resp = self.get(path)
+
+            assert resp.status_code == 200
+            assert len(resp.json()) == 3
+
+            assert (resp.json()[0]['mtime'] > resp.json()[1]['mtime'] and
+                    resp.json()[1]['mtime'] > resp.json()[2]['mtime'] )
+
     def test_can_delete(self):
         with self.get_tmp_group() as group:
             resp = self.create_group_repo(group.group_id)