check that forwarding_addresses is a list

ceod/api/members.py

@@ -39,6 +39,8 @@ def create_user():
     for attr in ['uid', 'cn', 'given_name', 'sn', 'forwarding_addresses']:
         if not body.get(attr):
             raise BadRequest(f"Attribute '{attr}' is missing or empty")
+    if type(body['forwarding_addresses']) is not list:
+        raise BadRequest('forwarding_addresses must be a list of email addresses')
 
     if terms:
         logger.info(f"Creating member {body['uid']} for terms {terms}")
@@ -53,7 +55,7 @@ def create_user():
         program=body.get('program'),
         terms=terms,
         non_member_terms=non_member_terms,
-        forwarding_addresses=body.get('forwarding_addresses'),
+        forwarding_addresses=body['forwarding_addresses'],
     )
     return create_streaming_response(txn)