diff --git a/RMuseum/Controllers/GanjoorController.cs b/RMuseum/Controllers/GanjoorController.cs
index 65398541..8fed7526 100644
--- a/RMuseum/Controllers/GanjoorController.cs
+++ b/RMuseum/Controllers/GanjoorController.cs
@@ -932,12 +932,12 @@ namespace RMuseum.Controllers
         }
 
         /// <summary>
-        /// add site banner (send form) with these fields: filename, alt, url and an image attachment
+        /// add site banner (send form) with these fields: alt, url and an image attachment
         /// </summary>
         /// <returns></returns>
         [HttpPost]
         [Route("site/banner")]
-        [AllowAnonymous]
+        [Authorize(Policy = RMuseumSecurableItem.GanjoorEntityShortName + ":" + RMuseumSecurableItem.Banners)]
         [ProducesResponseType((int)HttpStatusCode.OK, Type = typeof(GanjoorSiteBannerViewModel))]
         [ProducesResponseType((int)HttpStatusCode.BadRequest, Type = typeof(string))]
         [ProducesResponseType((int)HttpStatusCode.Unauthorized)]
@@ -945,29 +945,24 @@ namespace RMuseum.Controllers
         {
             try
             {
-                
                 if (!Request.Form.TryGetValue("alt", out Microsoft.Extensions.Primitives.StringValues alt))
                 {
                     return BadRequest("alt is null");
                 }
-
                 if (!Request.Form.TryGetValue("url", out Microsoft.Extensions.Primitives.StringValues url))
                 {
                     return BadRequest("url is null");
                 }
-
                 if(Request.Form.Files.Count != 1)
                 {
                     return BadRequest("a single image is not provided");
                 }
                 using Stream stream = Request.Form.Files[0].OpenReadStream();
                 RServiceResult<GanjoorSiteBannerViewModel> res = await _ganjoorService.AddSiteBanner(stream, Request.Form.Files[0].FileName, alt.ToString(), url.ToString(), false);
-
                 if (!string.IsNullOrEmpty(res.ExceptionString))
                 {
                     return BadRequest(res.ExceptionString);
                 }
-
                 return Ok(res.Result);
             }
             catch (Exception exp)
@@ -1086,7 +1081,7 @@ namespace RMuseum.Controllers
         /// <returns></returns>
         [HttpGet]
         [Route("site/banner")]
-        [Authorize(Policy = RMuseumSecurableItem.GanjoorEntityShortName + ":" + RMuseumSecurableItem.Banners)]
+        [AllowAnonymous]
         [ProducesResponseType((int)HttpStatusCode.OK, Type = typeof(GanjoorSiteBannerViewModel))]
         [ProducesResponseType((int)HttpStatusCode.BadRequest, Type = typeof(string))]
         [ProducesResponseType((int)HttpStatusCode.Unauthorized)]
@@ -1102,12 +1097,7 @@ namespace RMuseum.Controllers
                     return BadRequest(res.ExceptionString);
                 }
 
-                if(res.Result == null)
-                {
-                    return NotFound();
-                }
-
-                return Ok(res.Result);
+                return Ok(res.Result); //this might be null
             }
             catch (Exception exp)
             {
diff --git a/RMuseum/RMuseum.xml b/RMuseum/RMuseum.xml
index 1d3aeef5..cd3dd03a 100644
--- a/RMuseum/RMuseum.xml
+++ b/RMuseum/RMuseum.xml
@@ -885,7 +885,7 @@
         </member>
         <member name="M:RMuseum.Controllers.GanjoorController.AddSiteBanner">
             <summary>
-            add site banner (send form) with these fields: filename, alt, url and an image attachment
+            add site banner (send form) with these fields: alt, url and an image attachment
             </summary>
             <returns></returns>
         </member>
diff --git a/RMuseum/Services/Implementation/GanjoorService.cs b/RMuseum/Services/Implementation/GanjoorService.cs
index d7479d1f..eae189e0 100644
--- a/RMuseum/Services/Implementation/GanjoorService.cs
+++ b/RMuseum/Services/Implementation/GanjoorService.cs
@@ -2028,7 +2028,7 @@ namespace RMuseum.Services.Implementation
                     return new RServiceResult<GanjoorSiteBannerViewModel>(null);//not found
 
                 Random rnd = new Random(DateTime.Now.Millisecond);
-                int id = idSet[rnd.Next(0, idSet.Length - 1)];
+                int id = idSet[rnd.Next(0, idSet.Length)];
 
                 return new RServiceResult<GanjoorSiteBannerViewModel>(
                     await _context.GanjoorSiteBanners