diff -r 97f44b0720e2 -r 02bea04b4c54 mercurial/hgweb/hgweb_mod.py
--- a/mercurial/hgweb/hgweb_mod.py	Sat Mar 10 20:16:20 2018 -0800
+++ b/mercurial/hgweb/hgweb_mod.py	Sat Mar 10 18:19:27 2018 -0800
@@ -322,7 +322,7 @@
             res.headers['Content-Security-Policy'] = rctx.csp
 
         handled = wireprotoserver.handlewsgirequest(
-            rctx, wsgireq, req, res, self.check_perm)
+            rctx, req, res, self.check_perm)
         if handled:
             return res.sendresponse()
 
@@ -380,7 +380,7 @@
 
             # check read permissions non-static content
             if cmd != 'static':
-                self.check_perm(rctx, wsgireq, None)
+                self.check_perm(rctx, req, None)
 
             if cmd == '':
                 req.qsparams['cmd'] = tmpl.cache['default']