diff --git a/mercurial/hgweb/hgweb_mod.py b/mercurial/hgweb/hgweb_mod.py
--- a/mercurial/hgweb/hgweb_mod.py
+++ b/mercurial/hgweb/hgweb_mod.py
@@ -91,7 +91,12 @@ class hgweb(object):
         if cmd and cmd in protocol.__all__:
             try:
                 if cmd in perms:
-                    self.check_perm(req, perms[cmd])
+                    try:
+                        self.check_perm(req, perms[cmd])
+                    except ErrorResponse, inst:
+                        if cmd == 'unbundle':
+                            req.drain()
+                        raise
                 method = getattr(protocol, cmd)
                 return method(self.repo, req)
             except ErrorResponse, inst:
diff --git a/mercurial/hgweb/protocol.py b/mercurial/hgweb/protocol.py
--- a/mercurial/hgweb/protocol.py
+++ b/mercurial/hgweb/protocol.py
@@ -117,11 +117,7 @@ def unbundle(repo, req):
 
     # fail early if possible
     if not check_heads():
-        length = int(req.env.get('CONTENT_LENGTH', 0))
-        for s in util.filechunkiter(req, limit=length):
-            # drain incoming bundle, else client will not see
-            # response when run outside cgi script
-            pass
+        req.drain()
         raise ErrorResponse(HTTP_OK, 'unsynced changes')
 
     # do not lock repo until all changegroup data is
diff --git a/mercurial/hgweb/request.py b/mercurial/hgweb/request.py
--- a/mercurial/hgweb/request.py
+++ b/mercurial/hgweb/request.py
@@ -7,6 +7,7 @@
 # of the GNU General Public License, incorporated herein by reference.
 
 import socket, cgi, errno
+from mercurial import util
 from common import ErrorResponse, statusmessage
 
 shortcuts = {
@@ -57,6 +58,12 @@ class wsgirequest(object):
     def read(self, count=-1):
         return self.inp.read(count)
 
+    def drain(self):
+        '''need to read all data from request, httplib is half-duplex'''
+        length = int(self.env.get('CONTENT_LENGTH', 0))
+        for s in util.filechunkiter(self.inp, limit=length):
+            pass
+
     def respond(self, status, type=None, filename=None, length=0):
         if self._start_response is not None: