diff --git a/workflow/engine/src/ProcessMaker/Model/ProcessUser.php b/workflow/engine/src/ProcessMaker/Model/ProcessUser.php
index 5b741242b..59d79b927 100644
--- a/workflow/engine/src/ProcessMaker/Model/ProcessUser.php
+++ b/workflow/engine/src/ProcessMaker/Model/ProcessUser.php
@@ -38,11 +38,10 @@ class ProcessUser extends Model
      */
     public function scopeProcessGroupSupervisor($query, $userUid)
     {
-        $query->where('PU_TYPE', 'GROUP_SUPERVISOR');
-        $query->leftJoin('GROUP_USER', function ($leftJoin) use ($userUid) {
-            $leftJoin->on('PROCESS_USER.USR_UID', '=', 'GROUP_USER.GRP_UID')
-                ->where('GROUP_USER.USR_UID', $userUid);
-        });
+        // Ge the groups related to the user, Todo, implement the field PROCESS_USER.GRP_ID
+        $groups = GroupUser::getGroups($userUid, 'GRP_UID');
+        $query->where('PROCESS_USER.PU_TYPE', 'GROUP_SUPERVISOR');
+        $query->whereIn('PROCESS_USER.USR_UID', $groups);
         $query->joinProcess();
 
         return $query;
diff --git a/workflow/engine/src/ProcessMaker/Validation/SqlBlacklist.php b/workflow/engine/src/ProcessMaker/Validation/SqlBlacklist.php
index 6ebd17a96..b1fd7856e 100644
--- a/workflow/engine/src/ProcessMaker/Validation/SqlBlacklist.php
+++ b/workflow/engine/src/ProcessMaker/Validation/SqlBlacklist.php
@@ -100,6 +100,10 @@ class SqlBlacklist extends Parser
             $signed = get_class($statement);
             foreach (Parser::$STATEMENT_PARSERS as $key => $value) {
                 if ($signed === $value && in_array(strtoupper($key), $config['statements'])) {
+                    //SHOW statement is a special case, it does not require a table name
+                    if (strtoupper($key) === 'SHOW') {
+                        throw new Exception(G::loadTranslation('ID_INVALID_QUERY'));
+                    }
                     $notExecuteQuery = true;
                     break;
                 }
@@ -116,13 +120,16 @@ class SqlBlacklist extends Parser
                 if ($key === 'table' && is_string($value)) {
                     $callback($value);
                 }
+                if ($key === 'token' && is_string($value)) {
+                    $callback($value);
+                }
             }
         };
 
         //verify system tables
         $tables = $config['tables'];
-        $fn($this->statements, function ($table) use ($tables) {
-            if (in_array($table, $tables)) {
+        $fn($this->statements, function ($table) use ($tables, $notExecuteQuery) {
+            if (in_array($table, $tables) && $notExecuteQuery) {
                 throw new Exception(G::loadTranslation('ID_NOT_EXECUTE_QUERY', [$table]));
             }
         });