- LP #143403: Prevent accidental acquisition of objectValues during

  recursive ownership changes when the changed object has no
  objectValues method.

doc/CHANGES.rst

@@ -181,6 +181,10 @@ Features Added
 Bugs Fixed
 ++++++++++
 
+- LP #143403: Prevent accidental acquisition of objectValues during
+  recursive ownership changes when the changed object has no
+  objectValues method.
+
 - LP #142535: Fix faulty docstring for manage_changeProperties which
   incorrectly suggested that passing a simple dictionary as REQUEST
   argument was supported.

src/AccessControl/Owned.py

@@ -166,7 +166,8 @@ class Owned(Base):
                 return
 
         if recursive:
-            for child in self.objectValues():
+            children = getattr( aq_base(self), 'objectValues', lambda :() )()
+            for child in children:
                 child.changeOwnership(user, 1)
 
         if old is not UnownableOwner:

src/AccessControl/tests/testOwned.py

@@ -273,6 +273,24 @@ class OwnershipChangeTests(unittest.TestCase):
                          , (['acl_users'], 'user2')
                          )
 
+    def test_changeOwnership_recursive_objectValues_acquisition(self):
+        # See https://bugs.launchpad.net/bugs/143403
+        from AccessControl.Owned import Owned
+        class FauxContent(Implicit, Owned):
+            pass
+        previous_parent_owner = self.root.parent._owner
+        previous_child_owner = self.root.parent.child._owner
+        previous_grandchild_owner = self.root.parent.child.grandchild._owner
+        newuser = self.uf.getUser('user2').__of__(self.uf)
+        self.root.parent.bad = FauxContent()
+
+        self.root.parent.bad.changeOwnership(newuser, recursive=True)
+        self.assertEquals(self.root.parent._owner, previous_parent_owner)
+        self.assertEquals(self.root.parent.child._owner, previous_child_owner)
+        self.assertEquals( self.root.parent.child.grandchild._owner
+                         , previous_grandchild_owner
+                         )
+
 
 def test_suite():
     return unittest.TestSuite((