I believe request.environ should be used rather than simply request for checking for the REMOTE_HOST and REMOTE_ADDR keys in domainSpecMatch. Since the collector is down, I thought this is probably the best place to post bug reports. - j *** Zope-2.4.1-src/lib/python/AccessControl/User.py Sat Aug 4 22:49:26 2001 --- zope-2.4.1/lib/python/AccessControl/User.py Tue Sep 25 12:00:54 2001 *************** *** 1039,1048 **** if len(spec) == 1 and spec[0] == '*': return 1 ! if request.has_key('REMOTE_HOST'): host=request['REMOTE_HOST'] ! if request.has_key('REMOTE_ADDR'): addr=request['REMOTE_ADDR'] if not host and not addr: --- 1039,1048 --- if len(spec) == 1 and spec[0] == '*': return 1 ! if request.environ.has_key('REMOTE_HOST'): host=request.environ['REMOTE_HOST'] ! if request.environ.has_key('REMOTE_ADDR'): addr=request.environ['REMOTE_ADDR'] if not host and not addr: