Wrong Message if User doesn't exist in the system

Maybe the solution is to check if the user exists.

Update the patch with message

@rajdeep0826 could you please reroll this against 2.x?

I commented the MR. This still needs work, but the proposed changes are reducing security, so that's not a good thing.

And we should have a test for a non-existent user login try.

The expected result would be that trying to log in as a non-existent user is counted as a wrong login attempt, as it's a possible attack. But the message shown should be correct, of course.
Behind the scenes, it should be handled like a failed login attempt.

@Grevil could you add such a test and have a look at my comments in the MR?

Behind the scenes, it should be handled like a failed login attempt.

Unfortunately, this is not easily done, but I am on it.

After every login validation, the module checks which attempt settings are activated (soft host, hard host, user), compares the set values with the appropriate login count value (ip_current_count, user_current_count) and blocks them if necessary. Both count attributes are being fetched from the same database "login_security_track", which is created by this module.

Basically, it counts every table rows "host" / "name" entry based on the attempt setting.

Before, these database entries were only created if the typed in user really exists, I fixed this problem, by adding every login attempt to the database table. I hope this won't lead to errors on websites with huge traffic.

Furthermore, I am unsure if this concept really is the best approach... Drupal core's flood control should already have a logging table like this, we should discuss this in #3330627: [META] Improve behaviour with the user module's flood control.

FYI, a bunch of tests fail by my changes. For once, the hard blocking still doesn't work and the other tests need further investigation.

All done! Please review.

Code is fine! Once the tests go green, feel free to merge this.

All tests are green! Merging!