security MDL-18006 MDL-18807 MDL-20853 Several improvements to increase security

*  Installation
      o Adds a random $CFG->passwordsaltmain to config.php on install
      o Changes passwordpolicy default to on
* Upgrade
      o If passwordpolicy is off it switches it on
      o Checks if passwordsaltmain has been set and if not recommends to the user and all admins to add it, both on the upgrade output and via messaging.
      o Forces all admin users to change their password at next login.
* General
      o Extends the security overview report to check for passwordmainsalt and recommend if it not set (or weak)

lib/moodlelib.php

@@ -6831,6 +6831,30 @@ function random_string ($length=15) {
     return $string;
 }
 
+/**
+ * Generate a complex random string (usefull for md5 salts)
+ *
+ * This function is based on the above {@link random_string()} however it uses a
+ * larger pool of characters and generates a string between 24 and 32 characters
+ *
+ * @param int $length Optional if set generates a string to exactly this length
+ * @return string
+ */
+function complex_random_string($length=null) {
+    $pool  = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+    $pool .= '`~!@#%^&*()_+-=[];,./<>?:{} ';
+    $poollen = strlen($pool);
+    mt_srand ((double) microtime() * 1000000);
+    if ($length===null) {
+        $length = floor(rand(24,32));
+    }
+    $string = '';
+    for ($i = 0; $i < $length; $i++) {
+        $string .= $pool[(mt_rand()%$poollen)];
+    }
+    return $string;
+}
+
 /*
  * Given some text (which may contain HTML) and an ideal length,
  * this function truncates the text neatly on a word boundary if possible