Password generator & disabling moodle password policy

[lthamm]

The setups documentation (https://dualcube.com/docs/moowoodle-set-up-guide/#3-toc-title) requires disabling the password policy. This allows moodle users to set arbitrarily unsafe passwords.

The default moodle password policy is the following:

• Password length - 8
• Digits - 1
• Lowercase letters - 1
• Uppercase letters - 1
• Non-alphanumeric characters - 1 https://docs.moodle.org/310/en/Site_security_settings#Password_polic

moowoodle creates the passwords in the password generator, using four arrays as a source to pseudo-randomly build the password:

• Uppercase letters A - Z
• Lowercase letters a - z
• Digits 2 - 9 (for some reason without 1?)
• Non-numeric characters https://github.com/dualcube/moowoodle/blob/d6c6672eb1e4d0fb3c634a7a1ce61ebf8e17cc4a/classes/class-moowoodle-enrollment.php#L282

It appends one character character for each set for a length of 8 character. As long as I am not missing something, the password generator conforms with the moodle password policy by default and disabling the password policy is not necessary.

Moreover, the password_generator uses str_shuffle and array_rand, both of which are not cryptographically secure.

Suggestions:

• Remove the Password Policy recommendation from the Documentation
• Use random_int to generate more secure passwords