This issue was found in Heron (https://code.google.com/p/geoext-viewer/issues/detail?id=235) but applies to the function GeoExt.form.toFilter in
https://github.com/geoext/geoext/blob/master/lib/GeoExt/widgets/form.js
Problem is that in some forms with OR-ed fields where the user leaves fields empty and when wildcarding is enabled, the toFilter function will still add a wildcard to an empty string. In the worst case one may get the entire content of a DB. FIx is to skip filter encoding for fields with value is empty string and when wildcarding is one. We fixed this in Heron by overriding (also fixing other stuff), but may supply the fix as a pull as well. See fixed version here (line 267):
https://code.google.com/p/geoext-viewer/source/browse/trunk/heron/lib/override-geoext.js
This issue was found in Heron (https://code.google.com/p/geoext-viewer/issues/detail?id=235) but applies to the function GeoExt.form.toFilter in
https://github.com/geoext/geoext/blob/master/lib/GeoExt/widgets/form.js
Problem is that in some forms with OR-ed fields where the user leaves fields empty and when wildcarding is enabled, the toFilter function will still add a wildcard to an empty string. In the worst case one may get the entire content of a DB. FIx is to skip filter encoding for fields with value is empty string and when wildcarding is one. We fixed this in Heron by overriding (also fixing other stuff), but may supply the fix as a pull as well. See fixed version here (line 267):
https://code.google.com/p/geoext-viewer/source/browse/trunk/heron/lib/override-geoext.js