/*
 * Axelor Business Solutions
 *
 * Copyright (C) 2005-2018 Axelor (<http://axelor.com>).
 *
 * This program is free software: you can redistribute it and/or  modify
 * it under the terms of the GNU Affero General Public License, version 3,
 * as published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
package com.axelor.rpc.filter;

import java.util.Arrays;
import java.util.List;
import java.util.regex.Pattern;

import com.axelor.app.AppSettings;

public class JPQLFilter extends Filter {

	private static final boolean SUB_SELECT_ALLOWED = AppSettings.get().getBoolean("domain.allow.sub-select", true);

	private static final Pattern SUB_SELECT_PATTERN = Pattern.compile("\\(\\s*SELECT\\s+", Pattern.CASE_INSENSITIVE);

	private String jpql;

	private Object[] params;

	public JPQLFilter(String jpql, Object... params) {
		this.jpql = jpql;
		this.params = params;
	}

	public static JPQLFilter forDomain(String jpql, Object... params) {
		if (!SUB_SELECT_ALLOWED && SUB_SELECT_PATTERN.matcher(jpql).find()) {
			throw new IllegalArgumentException("Invalid domain, sub queries are not allowed.");
		}
		return new JPQLFilter(jpql, params);
	}

	@Override
	public String getQuery() {
		return "(" + this.jpql + ")";
	}

	@Override
	public List<Object> getParams() {
		return Arrays.asList(this.params);
	}
}

@@ -914,34 +914,33 @@
 nal 
-boolean SUB_SELECT_ALLOWED
+Pattern BLACKLIST_PATTERN
  = A
@@ -963,15 +963,8 @@
 .get
-Boolean
 (%22do
@@ -972,121 +972,129 @@
 ain.
-allow.sub-select%22, true);%0A%0A%09private static final Pattern SUB_SELECT_PATTERN = Pattern.compile(%22%5C%5C(%5C%5Cs*SELECT%5C%5Cs+%22
+blacklist.pattern%22, null) == null%0A%09%09%09? null%0A%09%09%09: Pattern.compile(AppSettings.get().get(%22domain.blacklist.pattern%22).trim()
 , Pa
@@ -1348,40 +1348,45 @@
 if (
-!SUB_SELECT_ALLOWED && SUB_SELEC
+BLACKLIST_PATTERN != null && BLACKLIS
 T_PA
@@ -1474,35 +1474,40 @@
 in, 
-sub queries are not allowed
+filter uses blacklisted keywords
 .%22);

Add support for domain filter blacklist pattern