--- a/mercurial/hgweb/hgweb_mod.py	Sat Jan 03 20:20:40 2009 +0100
+++ b/mercurial/hgweb/hgweb_mod.py	Sat Jan 03 21:44:15 2009 +0100
@@ -284,14 +284,13 @@
             raise ErrorResponse(HTTP_UNAUTHORIZED, 'read not authorized')
 
         allow_read = self.configlist('web', 'allow_read')
-        result = (not allow_read) or (allow_read == ['*']) or (user in allow_read)
-        if not result:
+        result = (not allow_read) or (allow_read == ['*'])
+        if not result or user in allow_read:
             raise ErrorResponse(HTTP_UNAUTHORIZED, 'read not authorized')
 
         if op == 'pull' and not self.allowpull:
             raise ErrorResponse(HTTP_UNAUTHORIZED, 'pull not authorized')
-        # op is None when checking allow/deny_read permissions for a web-browser request
-        elif op == 'pull' or op is None:
+        elif op == 'pull' or op is None: # op is None for interface requests
             return
 
         # enforce that you can only push using POST requests