Password is unexpectedly visible on the 'My Account' page when JS disabled

I think that when Javascript is disabled, it should provide a dedicated link to load the password manually to its own "page".
With JS enabled, the link should collapse so the password is initially hidden behind the link, then revealed inline when clicking on the link.
(Setting it for 7.x first, which then may be backported.)

Personally, I think this might be considered a security issue. Not everyone uses JS.

It is mitigated to a certain extent by the fact that only the user will see it him/herself.

What's the best way to handle this, do you think?

There are ajax link for showing password on user page.

1. +++ b/aes.module
   @@ -421,6 +430,32 @@ function aes_user_view($account, $view_mode, $langcode) {
   +function aes_password_view($uid) {
   +  $output = '<div id="aes_password">';
   +  drupal_add_library('system', 'drupal.ajax');
   +  $link = l(t('Show pass'), 'aes_get_password_callback/' .$uid. '/nojs/', array('attributes' => array('class' => array('use-ajax'))));
   +  $output .= "$link</div>";
   +  return $output;
   +}
   

   I think code from this function should move to line 416.
   There is no need for new custom function.
   Please note to space after dots. And line length should be less than 80 characters

2. +++ b/aes.module
   @@ -421,6 +430,32 @@ function aes_user_view($account, $view_mode, $langcode) {
   +
   

   Please add documentation for function.

+++ b/aes.module
@@ -403,11 +412,11 @@ function aes_user_view($account, $view_mode, $langcode) {
-      $password_form = drupal_get_form('aes_view_password_form', aes_get_password($account->uid, TRUE));

If aes_view_password_form is never used, should be remove function code from module

1. +++ b/aes.module
   @@ -35,6 +35,15 @@ function aes_menu() {
   +    'title' => 'User password',
   

   User's pasword

2. +++ b/aes.module
   @@ -421,6 +430,32 @@ function aes_user_view($account, $view_mode, $langcode) {
   +function aes_password_view($uid) {
   

   Needs docblock

3. +++ b/aes.module
   @@ -421,6 +430,32 @@ function aes_user_view($account, $view_mode, $langcode) {
   +function aes_ajax_callback($uid, $type = 'ajax') {
   

   Needs docblock

There is patch with fixed bugs.

Code looks good for me.