User Story

As an application developer, I hope a UI framework works with the safest policy by default, no need developer to enable it manually. But provide a way to disable/override the limit.

Acceptance Criteria

1. Enable InaccessibleWidgetBlockService by default to block disabled or invisible components
2. app developers can disable the default blocking service. (This can be a special case of apply a custom blocking service)
3. app developers can apply their own custom blocking service.

Details

• Enable InaccessibleWidgetBlockService to make ZK framework safer by default. There is a rare case that end-users require to click a disabled button.
• https://forum.zkoss.org/question/114690/vulnerability-detected-textbox-with-bind-but-disabled-chrome-debugger-opens-backdoor/