- LP #143403: Prevent accidental acquisition of objectValues during

  recursive ownership changes when the changed object has no
  objectValues method.

doc/CHANGES.rst

@@ -11,6 +11,10 @@ http://docs.zope.org/zope2/releases/.
 Bugs Fixed
 ++++++++++
 
+- LP #143403: Prevent accidental acquisition of objectValues during
+  recursive ownership changes when the changed object has no 
+  objectValues method.
+
 - LP #374818: Use module-provided functions as opposed to the old 
   "folder methods" when creating folders and user folders in 
   ZopeTestCase.

src/AccessControl/Owned.py

@@ -167,7 +167,8 @@ class Owned(Base):
                 return
 
         if recursive:
-            for child in self.objectValues():
+            children = getattr( aq_base(self), 'objectValues', lambda :() )()
+            for child in children:
                 child.changeOwnership(user, 1)
 
         if old is not UnownableOwner:

src/AccessControl/tests/testOwned.py

@@ -258,6 +258,24 @@ class OwnershipChangeTests(unittest.TestCase):
                          , (['acl_users'], 'user2')
                          )
 
+    def test_changeOwnership_recursive_objectValues_acquisition(self):
+        # See https://bugs.launchpad.net/bugs/143403
+        from AccessControl.Owned import Owned
+        class FauxContent(Implicit, Owned):
+            pass
+        previous_parent_owner = self.root.parent._owner
+        previous_child_owner = self.root.parent.child._owner
+        previous_grandchild_owner = self.root.parent.child.grandchild._owner
+        newuser = self.uf.getUser('user2').__of__(self.uf)
+        self.root.parent.bad = FauxContent()
+
+        self.root.parent.bad.changeOwnership(newuser, recursive=True)
+        self.assertEquals(self.root.parent._owner, previous_parent_owner)
+        self.assertEquals(self.root.parent.child._owner, previous_child_owner)
+        self.assertEquals( self.root.parent.child.grandchild._owner
+                         , previous_grandchild_owner
+                         )
+
 
 def test_suite():
     return unittest.TestSuite((