diff --git a/app.py b/app.py
index 1a565d5..552766c 100644
--- a/app.py
+++ b/app.py
@@ -1,15 +1,18 @@
-from flask import Flask
+from flask import Flask, request
 import os
 import urllib.request
 from icalendar.cal import Calendar, Component
 
 app = Flask(__name__)
 
-FILTERED_COURSES = os.environ.get('COURSES', '').split(',')
-FILTERED_TYPES = os.environ.get('TYPES', '').split(',')
+EXCLUDED_COURSES = os.environ.get('COURSES', '').split(',')
+EXCLUDED_TYPES = os.environ.get('TYPES', '').split(',')
 YEAR = os.environ.get('YEAR', '4')
 GROUP = os.environ.get('GROUP', '1')
 
+ALLOWED_YEARS = os.environ.get('ALLOWED_YEARS', '3,4,5').split(',')
+ALLOWED_GROUPS = os.environ.get('ALLOWED_GROUPS', '1,2,3').split(',')
+
 
 @app.route("/")
 def hello():
@@ -17,7 +20,24 @@ def hello():
     if url is None:
         return ""
 
-    url += "&promo={year}&groupe={group}".format(year=YEAR, group=GROUP)
+    year = request.args.get('year', '')
+    group = request.args.get('group', '')
+
+    try:
+        int(year)
+        if year not in ALLOWED_YEARS:
+            raise ValueError('year not allowed')
+    except ValueError:
+        year = YEAR
+
+    try:
+        int(group)
+        if group not in ALLOWED_GROUPS:
+            raise ValueError('group not allowed')
+    except ValueError:
+        group = GROUP
+
+    url += "&promo={year}&groupe={group}".format(year=year, group=group)
     cal_str = urllib.request.urlopen(url).read()
 
     cal = Component.from_ical(cal_str)
@@ -43,8 +63,8 @@ def should_add(event):
     course_type = event['SUMMARY'].split('/')[1].split('_')[1]
 
     return \
-        course_code not in FILTERED_COURSES \
-        and course_type not in FILTERED_TYPES
+        course_code not in EXCLUDED_COURSES \
+        and course_type not in EXCLUDED_TYPES
 
 if __name__ == "__main__":
     port = int(os.environ.get('PORT', 5000))