Notify of failed logins only for existing accounts (#172)

CHANGELOG

@@ -15,6 +15,11 @@
     adjusts the delay and allowed-attempts threshold; optional progressive
     (exponential) block duration for repeat offenders; password reset/
     username reminder now stay reachable even for a blocked IP
+  - Notifications of failed logins only for existing accounts (#172): the new
+    setting "Failed msgs only for existing accounts" restricts the failed
+    login notification to attempts with a username or email address which
+    belongs to a registered account; attempts with other names are still
+    recorded and counted towards blocking
   - Local GeoIP lookup (issue #169): "Information for IP Address" in the
     component now shows real country/region/city/coordinates again via a
     locally-configured MaxMind .mmdb database, instead of the discontinued

language/de-DE/de-DE.plg_system_bfstop.sys.ini

@@ -12,6 +12,8 @@ PLG_SYSTEM_BFSTOP_EMAIL_ADDRESS_LABEL="Email-Adresse(n)"
 PLG_SYSTEM_BFSTOP_EMAIL_ADDRESS_DESC="Die Email-Adresse(n) eingeben, an die die Benachrichtigungen gesendet werden sollen. Wenn mehrere Adressen eingegeben werden, müssen diese durch einen Strichpunkt (;) getrennt werden."
 PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_NUMBER_LABEL="Fehlgeschlagen-Nachrichten"
 PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_NUMBER_DESC="Wie oft an einem Tag maximal eine Benachrichtigung über fehlgeschlagene Login-Versuche gesendet werden soll."
+PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_ONLY_EXISTING_LABEL="Fehlgeschlagen-Nachrichten nur für existierende Konten"
+PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_ONLY_EXISTING_DESC="Nur dann über einen fehlgeschlagenen Login-Versuch benachrichtigen, wenn der eingegebene Benutzername (oder die E-Mail-Adresse) zu einem existierenden Konto gehört. Versuche mit Namen, die auf dieser Seite nicht registriert sind (typischerweise Bots, die Benutzernamen raten), werden weiterhin aufgezeichnet und für das Blockieren mitgezählt, lösen aber keine Benachrichtigung aus."
 PLG_SYSTEM_BFSTOP_NOTIFY_BLOCKED_NUMBER_LABEL="Blockiert-Nachrichten"
 PLG_SYSTEM_BFSTOP_NOTIFY_BLOCKED_NUMBER_DESC="Wie oft an einem Tag maximal eine Benachrichtigung über blockierte IP-Adressen gesendet werden soll."
 PLG_SYSTEM_BFSTOP_DELAY_DURATION_LABEL="Verzögerung"

language/en-GB/en-GB.plg_system_bfstop.sys.ini

@@ -14,6 +14,8 @@ PLG_SYSTEM_BFSTOP_EMAIL_ADDRESS_LABEL="Email Address(es)"
 PLG_SYSTEM_BFSTOP_EMAIL_ADDRESS_DESC="Enter the Email Address(es) where you would like to have notifications to be sent. If you want to specify more than one address, separate them by the semicolon character (;)."
 PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_NUMBER_LABEL="Failed msgs per day"
 PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_NUMBER_DESC="How often to notify about a failed login during one day"
+PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_ONLY_EXISTING_LABEL="Failed msgs only for existing accounts"
+PLG_SYSTEM_BFSTOP_NOTIFY_FAILED_ONLY_EXISTING_DESC="Only notify about a failed login if the username (or email address) which was entered belongs to an existing account. Attempts with names which are not registered on this site (typically bots guessing usernames) are still recorded and counted towards blocking, but do not trigger a notification."
 PLG_SYSTEM_BFSTOP_NOTIFY_BLOCKED_NUMBER_LABEL="Blocked msgs per day"
 PLG_SYSTEM_BFSTOP_NOTIFY_BLOCKED_NUMBER_DESC="How often to notify about a blocked IP during one day"
 PLG_SYSTEM_BFSTOP_DELAY_DURATION_LABEL="Delay"

src/Extension/Bfstop.php

@@ -565,8 +565,18 @@ public function onUserLoginFailure($event)
 
 		$this->notifyOfRemainingAttempts($logEntry, $riskScore);
 
-		$maxNumber = $this->getIntParam('notifyFailedNumber', 0);
-		$this->notifier->failedLogin($logEntry, $maxNumber);
+		// $username is what was typed; the entry only holds a hash of it if
+		// it isn't an account (see usernameForStorage())
+		if ($this->getBoolParam('notifyFailedOnlyExisting', false) &&
+			!$this->mydb->accountExists($username))
+		{
+			$this->logger->log('Not notifying of failed login: the username does not belong to an account', Log::DEBUG);
+		}
+		else
+		{
+			$maxNumber = $this->getIntParam('notifyFailedNumber', 0);
+			$this->notifier->failedLogin($logEntry, $maxNumber);
+		}
 		$this->blockIfTooManyAttempts($logEntry, $riskScore);
 
 		$delayDuration = $this->accountThrottleDelay($logEntry) + $this->determineDelayDuration($riskScore);