pithos: Handle database errors during permission updates

Refs: #4502

docs/pithos-api-guide.rst

@@ -1085,6 +1085,7 @@ Return Code                     Description
 ==============================  ==============================
 202 (Accepted)                  The request has been accepted (not a data update)
 204 (No Content)                The request succeeded (data updated)
+400 (Bad Request)               Invalid ``X-Object-Sharing`` or ``X-Object-Bytes`` header or missing ``Content-Range`` header or invalid source object or source object length is smaller than range length or ``Content-Length`` does not match range length
 411 (Length Required)           Missing ``Content-Length`` in the request
 413 (Request Entity Too Large)  Insufficient quota to complete the request
 416 (Range Not Satisfiable)     The supplied range is invalid

snf-pithos-app/pithos/api/test/objects.py

@@ -1882,6 +1882,20 @@ class ObjectPost(PithosAPITest):
         content = r.content
         self.assertEqual(content, d2 + d3[-1])
 
+    def test_update_invalid_permissions(self):
+        url = join_urls(self.pithos_path, self.user, self.container,
+                        self.object)
+        r = self.post(url, content_type='', HTTP_CONTENT_RANGE='bytes */*',
+                      HTTP_X_OBJECT_SHARING='%s' % (257*'a'))
+        self.assertEqual(r.status_code, 400)
+
+        r = self.post(url, content_type='', HTTP_CONTENT_RANGE='bytes */*',
+                      HTTP_X_OBJECT_SHARING='read=%s' % (257*'a'))
+        self.assertEqual(r.status_code, 400)
+
+        r = self.post(url, content_type='', HTTP_CONTENT_RANGE='bytes */*',
+                      HTTP_X_OBJECT_SHARING='write=%s' % (257*'a'))
+        self.assertEqual(r.status_code, 400)
 
 class ObjectDelete(PithosAPITest):
     def setUp(self):

snf-pithos-backend/pithos/backends/modular.py

@@ -933,9 +933,13 @@ class ModularBackend(BaseBackend):
         path = self._lookup_object(account, container, name,
                                    lock_container=True)[0]
         self._check_permissions(path, permissions)
-        self.permissions.access_set(path, permissions)
-        self._report_sharing_change(user, account, path, {'members':
-                                    self.permissions.access_members(path)})
+        try:
+            self.permissions.access_set(path, permissions)
+        except:
+            raise ValueError
+        else:
+            self._report_sharing_change(user, account, path, {'members':
+                                        self.permissions.access_members(path)})
 
     @debug_method
     def get_object_public(self, user, account, container, name):