* PATCHing an invalid attribute on a member did not give a 400 error

  (LP: #833376).  Given by Stephen A. Goss.

3 files changed, 22 insertions, 2 deletions

diff --git a/src/mailman/docs/NEWS.rst b/src/mailman/docs/NEWS.rst
index 2a59835d6..d2b6a8ccb 100644
--- a/src/mailman/docs/NEWS.rst
+++ b/src/mailman/docs/NEWS.rst
@@ -51,6 +51,8 @@ REST
    Stephen A. Goss.
  * Getting the roster or configuration of a nonexistent list did not give a
    404 error (LP: #837676).  Given by Stephen A. Goss.
+ * PATCHing an invalid attribute on a member did not give a 400 error
+   (LP: #833376).  Given by Stephen A. Goss.
 
 Commands
 --------
diff --git a/src/mailman/rest/members.py b/src/mailman/rest/members.py
index e7d0a095f..8f447ac75 100644
--- a/src/mailman/rest/members.py
+++ b/src/mailman/rest/members.py
@@ -140,8 +140,10 @@ class AMember(_MemberBase):
         """
         if self._member is None:
             return http.not_found()
-        # Currently, only the `address` parameter can be patched.
-        values = Validator(address=unicode)(request)
+        try:
+            values = Validator(address=unicode)(request)
+        except ValueError as error:
+            return http.bad_request([], str(error))
         assert len(values) == 1, 'Unexpected values'
         email = values['address']
         address = getUtility(IUserManager).get_address(email)
diff --git a/src/mailman/rest/tests/test_membership.py b/src/mailman/rest/tests/test_membership.py
index db1c2e4d2..8a315e359 100644
--- a/src/mailman/rest/tests/test_membership.py
+++ b/src/mailman/rest/tests/test_membership.py
@@ -203,6 +203,22 @@ class TestMembership(unittest.TestCase):
         else:
             raise AssertionError('Expected HTTPError')
 
+    def test_patch_bogus_member_attribute_400(self):
+        # /members/<id> PATCH 'bogus' returns 400
+        anne = self._usermanager.create_address('anne@example.com')
+        self._mlist.subscribe(anne)
+        config.db.commit()
+        try:
+            # For Python 2.6
+            call_api('http://localhost:9001/3.0/members/1', {
+                     'powers': 'super',
+                     }, method='PATCH')
+        except HTTPError as exc:
+            self.assertEqual(exc.code, 400)
+            self.assertEqual(exc.msg, 'Unexpected parameters: powers')
+        else:
+            raise AssertionError('Expected HTTPError')
+
 
 
 def test_suite():