fix ignoring the get_queryset() of ModelAdmin and get_base_queryset()…

… of InstanceSpecificView

-this fixes #5727

wagtail/contrib/modeladmin/tests/test_simple_modeladmin.py

@@ -5,6 +5,7 @@
 from django.contrib.auth.models import Group, Permission
 from django.contrib.contenttypes.models import ContentType
 from django.core import checks
+from django.db.models import Q
 from django.test import TestCase, TransactionTestCase
 from django.test.utils import override_settings
 from django.utils.timezone import make_aware
@@ -572,6 +573,24 @@ def get_for_author(self, author_id):
     def get_for_book(self, book_id):
         return self.client.get("/admin/modeladmintest/book/inspect/%d/" % book_id)
 
+    def test_base_queryset(self):
+        def exclude_id1(self, request):
+            return Book.objects.filter(~Q(id=1))
+
+        BookModelAdmin.get_queryset = exclude_id1
+
+        response = self.get_for_book(1)
+        self.assertEqual(response.status_code, 404)
+
+    def test_queryset(self):
+        def exclude_id1(self, request):
+            return Book.objects.filter(~Q(id=1))
+
+        BookModelAdmin.inspect_view_class.get_base_queryset = exclude_id1
+
+        response = self.get_for_book(1)
+        self.assertEqual(response.status_code, 404)
+
     def test_author_simple(self):
         response = self.get_for_author(1)
         self.assertEqual(response.status_code, 200)
@@ -668,6 +687,28 @@ def post(self, book_id, post_data):
             "/admin/modeladmintest/book/edit/%d/" % book_id, post_data
         )
 
+    def test_base_queryset(self):
+        def exclude_id1(self, request):
+            return Book.objects.filter(~Q(id=1))
+
+        BookModelAdmin.get_queryset = exclude_id1
+
+        response = self.get(1)
+        self.assertEqual(response.status_code, 404)
+        response = self.post(1, None)
+        self.assertEqual(response.status_code, 404)
+
+    def test_queryset(self):
+        def exclude_id1(self, request):
+            return Book.objects.filter(~Q(id=1))
+
+        BookModelAdmin.edit_view_class.get_base_queryset = exclude_id1
+
+        response = self.get(1)
+        self.assertEqual(response.status_code, 404)
+        response = self.post(1, None)
+        self.assertEqual(response.status_code, 404)
+
     def test_simple(self):
         response = self.get(1)
 

wagtail/contrib/modeladmin/views.py

@@ -275,17 +275,21 @@ def __init__(self, model_admin, instance_pk):
         super().__init__(model_admin)
         self.instance_pk = unquote(instance_pk)
         self.pk_quoted = quote(self.instance_pk)
-        filter_kwargs = {self.pk_attname: self.instance_pk}
-        object_qs = model_admin.model._default_manager.get_queryset().filter(
-            **filter_kwargs
-        )
-        self.instance = get_object_or_404(object_qs)
+        self.filter_kwargs = {self.pk_attname: self.instance_pk}
 
         if getattr(settings, "WAGTAIL_I18N_ENABLED", False) and issubclass(
             model_admin.model, TranslatableMixin
         ):
             self.locale = self.instance.locale
 
+    @method_decorator(login_required)
+    def dispatch(self, request, *args, **kwargs):
+        self.instance = get_object_or_404(
+            self.get_base_queryset(request), **self.filter_kwargs
+        )
+
+        return super(InstanceSpecificView, self).dispatch(request, *args, **kwargs)
+
     def get_page_subtitle(self):
         return self.instance