--- w2web.orig	2007-01-25 10:40:35.000000000 +0100
+++ w2web	2019-12-26 11:21:26.772837875 +0100
@@ -383,10 +383,11 @@
 $page =~ s/%(..)/pack("c",hex($1))/ge;
 
 # check address against access list
-if (@deny && &ip_match($acptip, @deny) ||
-    @allow && !&ip_match($acptip, @allow)) {
+if (@deny && &ip_match($acptip, @deny)) {
+    if (!@allow || !&ip_match($acptip, @allow)) {
 	&http_error(403, "Access denied for $acptip");
 	}
+}
 
 # Check for password if needed
 if (%users) {
@@ -817,6 +818,7 @@
 {
 local (@rv, $i);
 foreach $i (@_) {
+	$i =~ s/\*/0/g;
 	if ($i =~ /(\S+)\/(\S+)/) { push(@rv, $i); }
 	else { push(@rv, join('.', unpack("CCCC", inet_aton($i)))); }
 	}
