Thank you for the write up.
Joshua Biggs
2

Hey, I was a bit sleep deprived when answering this reply at first. Yes, I mean calling ringContract from another contract will give you control of the Telephone contract.

This is because the check in “changeOwner” will pass, since tx.origin will be equal to the address of the contract calling the “ringContract” function, while msg.sender will be equal to the address of the “Patrick” contract.

Now I wish I had named things in my example in a more straight forward way!

Anyways you’re effectively piping through patrick to change the msg.sender that the Telephone contract will see.