Now I have whitelists and blacklists and a quick way to change the default. In order to get around the problem that some of KM's items like "send page as a link" under "Mail" need injectJS, I have added some code to check the policy manager default. See this thread to find where I got the idea: http://kmeleon.sourceforge.net/forum/read.php?9,116553,116563#msg-116563
This is the code that I changed in Main.kmm. I will likely change every instance of injectJS just to make everything automatic.
# Same as JS_hndlDoc, but only for the topmost frame (to avoid cross site scripting).
$FlipFlip = false;
$JS_doit=""; $JS_func=""; $JS_last=""; $JS_fail="";