Index: branches/stable/cgi-bin/main.cgi
===================================================================
--- branches/stable/cgi-bin/main.cgi	(revision 266)
+++ branches/stable/cgi-bin/main.cgi	(revision 267)
@@ -889,15 +889,20 @@
       my $city;
       my $failmsg;
+      my $extracond = '';
+      if ($webvar{allocfrom} eq '-') {
+	$extracond = ($webvar{allowpriv} eq 'on' ? '' : 
+		" and not (cidr <<= '192.168.0.0/16'".
+			" or cidr <<= '10.0.0.0/8'".
+			" or cidr <<= '172.16.0.0/12')");
+      }
+      my $sortorder;
       if ($webvar{alloctype} eq 'rm') {
         if ($webvar{allocfrom} ne '-') {
 	  $sql = "select * from freeblocks where maskbits<=$webvar{maskbits} and routed='n'".
-		" and cidr <<= '$webvar{allocfrom}' order by maskbits desc";
+		" and cidr <<= '$webvar{allocfrom}'";
+	  $sortorder = "maskbits desc";
 	} else {
-	  $sql = "select * from freeblocks where maskbits<=$webvar{maskbits} and routed='n'".
-		($webvar{allowpriv} eq 'on' ? '' : 
-		" and not (cidr <<= '192.168.0.0/16'".
-			" or cidr <<= '10.0.0.0/8'".
-			" or cidr <<= '172.16.0.0/12')").
-		" order by maskbits desc";
+	  $sql = "select * from freeblocks where maskbits<=$webvar{maskbits} and routed='n'";
+	  $sortorder = "maskbits desc";
 	}
 	$failmsg = "No suitable free block found.<br>\nWe do not have a free".
@@ -928,11 +933,13 @@
 	  $sql = "select cidr from freeblocks where city='$city' and maskbits<=$webvar{maskbits}".
 		" and cidr <<= '$webvar{allocfrom}' and routed='".
-		(($webvar{alloctype} =~ /^(.)r$/) ? "$1" : 'y')."' order by maskbits desc,cidr";
+		(($webvar{alloctype} =~ /^(.)r$/) ? "$1" : 'y')."'";
+	  $sortorder = "maskbits desc,cidr";
 	} else {
 	  $sql = "select cidr from freeblocks where city='$city' and maskbits<=$webvar{maskbits}".
-		" and routed='".(($webvar{alloctype} =~ /^(.)r$/) ? "$1" : 'y').
-		"' order by maskbits desc,cidr";
+		" and routed='".(($webvar{alloctype} =~ /^(.)r$/) ? "$1" : 'y')."'";
+	  $sortorder = "maskbits desc,cidr";
 	}
       }
+      $sql = $sql.$extracond." order by ".$sortorder;
       $sth = $ip_dbh->prepare($sql);
       $sth->execute;