From 209b71f9339e18f4b6ac5280a08a213d011a9c21 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 12 Oct 2026 19:43:19 +0000 Subject: [PATCH] Notify of failed logins only for existing accounts (#172) New setting notifyFailedOnlyExisting: failed login notifications are only sent if the entered username or email address belongs to an existing account. Other attempts are still recorded and counted. Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_013HDvAhe4W1FxjobS8Etch2 --- CHANGELOG | 5 +++++ language/de-DE/de-DE.plg_system_bfstop.sys.ini | 2 ++ language/en-GB/en-GB.plg_system_bfstop.sys.ini | 2 ++ src/Extension/Bfstop.php | 14 ++++++++++++-- 4 files changed, 21 insertions(+), 2 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 3d4cff6..c472757 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -15,6 +15,11 @@ adjusts the delay and allowed-attempts threshold; optional progressive (exponential) block duration for repeat offenders; password reset/ username reminder now stay reachable even for a blocked IP + - Notifications of failed logins only for existing accounts (#172): the new + setting "Failed msgs only for existing accounts" restricts the failed + login notification to attempts with a username or email address which + belongs to a registered account; attempts with other names are still + recorded and counted towards blocking - Local GeoIP lookup (issue #169): "Information for IP Address" in the component now shows real country/region/city/coordinates again via a locally-configured MaxMind .mmdb database, instead of the discontinued diff --git a/language/de-DE/de-DE.plg_system_bfstop.sys.ini b/language/de-DE/de-DE.plg_system_bfstop.sys.ini index 658e7a8..adb9ba6 100644 --- a/language/de-DE/de-DE.plg_system_bfstop.sys.ini +++ b/language/de-DE/de-DE.plg_system_bfstop.sys.ini @@ -12,6 +12,8 @@ PLG_SYSTEM_BFSTOP_EMAIL_ADDRESS_LABEL="Email-Adresse(n)" PLG_SYSTEM_BFSTOP_EMAIL_ADDRESS_DESC="Die Email-Adresse(n) eingeben, an die die Benachrichtigungen gesendet werden sollen. Wenn mehrere Adressen eingegeben werden, müssen diese durch einen Strichpunkt (;) getrennt werden." PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_NUMBER_LABEL="Fehlgeschlagen-Nachrichten" PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_NUMBER_DESC="Wie oft an einem Tag maximal eine Benachrichtigung über fehlgeschlagene Login-Versuche gesendet werden soll." +PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_ONLY_EXISTING_LABEL="Fehlgeschlagen-Nachrichten nur für existierende Konten" +PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_ONLY_EXISTING_DESC="Nur dann über einen fehlgeschlagenen Login-Versuch benachrichtigen, wenn der eingegebene Benutzername (oder die E-Mail-Adresse) zu einem existierenden Konto gehört. Versuche mit Namen, die auf dieser Seite nicht registriert sind (typischerweise Bots, die Benutzernamen raten), werden weiterhin aufgezeichnet und für das Blockieren mitgezählt, lösen aber keine Benachrichtigung aus." PLG_SYSTEM_BFSTOP_NOTIFY_BLOCKED_NUMBER_LABEL="Blockiert-Nachrichten" PLG_SYSTEM_BFSTOP_NOTIFY_BLOCKED_NUMBER_DESC="Wie oft an einem Tag maximal eine Benachrichtigung über blockierte IP-Adressen gesendet werden soll." PLG_SYSTEM_BFSTOP_DELAY_DURATION_LABEL="Verzögerung" diff --git a/language/en-GB/en-GB.plg_system_bfstop.sys.ini b/language/en-GB/en-GB.plg_system_bfstop.sys.ini index 7a2b7d2..ccf3a27 100644 --- a/language/en-GB/en-GB.plg_system_bfstop.sys.ini +++ b/language/en-GB/en-GB.plg_system_bfstop.sys.ini @@ -14,6 +14,8 @@ PLG_SYSTEM_BFSTOP_EMAIL_ADDRESS_LABEL="Email Address(es)" PLG_SYSTEM_BFSTOP_EMAIL_ADDRESS_DESC="Enter the Email Address(es) where you would like to have notifications to be sent. If you want to specify more than one address, separate them by the semicolon character (;)." PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_NUMBER_LABEL="Failed msgs per day" PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_NUMBER_DESC="How often to notify about a failed login during one day" +PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_ONLY_EXISTING_LABEL="Failed msgs only for existing accounts" +PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_ONLY_EXISTING_DESC="Only notify about a failed login if the username (or email address) which was entered belongs to an existing account. Attempts with names which are not registered on this site (typically bots guessing usernames) are still recorded and counted towards blocking, but do not trigger a notification." PLG_SYSTEM_BFSTOP_NOTIFY_BLOCKED_NUMBER_LABEL="Blocked msgs per day" PLG_SYSTEM_BFSTOP_NOTIFY_BLOCKED_NUMBER_DESC="How often to notify about a blocked IP during one day" PLG_SYSTEM_BFSTOP_DELAY_DURATION_LABEL="Delay" diff --git a/src/Extension/Bfstop.php b/src/Extension/Bfstop.php index c6ae943..e43858e 100644 --- a/src/Extension/Bfstop.php +++ b/src/Extension/Bfstop.php @@ -565,8 +565,18 @@ public function onUserLoginFailure($event) $this->notifyOfRemainingAttempts($logEntry, $riskScore); - $maxNumber = $this->getIntParam('notifyFailedNumber', 0); - $this->notifier->failedLogin($logEntry, $maxNumber); + // $username is what was typed; the entry only holds a hash of it if + // it isn't an account (see usernameForStorage()) + if ($this->getBoolParam('notifyFailedOnlyExisting', false) && + !$this->mydb->accountExists($username)) + { + $this->logger->log('Not notifying of failed login: the username does not belong to an account', Log::DEBUG); + } + else + { + $maxNumber = $this->getIntParam('notifyFailedNumber', 0); + $this->notifier->failedLogin($logEntry, $maxNumber); + } $this->blockIfTooManyAttempts($logEntry, $riskScore); $delayDuration = $this->accountThrottleDelay($logEntry) + $this->determineDelayDuration($riskScore);