mass_change_view() should also call get_queryset() from admin_obj

massadmin/massadmin.py

@@ -217,7 +217,7 @@ def mass_change_view(
         queryset = getattr(
             self.admin_obj,
             "massadmin_queryset",
-            self.get_queryset)(request)
+            self.admin_obj.get_queryset)(request)
 
         object_ids = comma_separated_object_ids.split(',')
         object_id = object_ids[0]

tests/admin.py

@@ -35,6 +35,9 @@ class CustomAdmin(admin.ModelAdmin):
     model = CustomAdminModel
     form = CustomAdminForm
 
+    def get_queryset(self, request):
+        return CustomAdminModel.objects.exclude(name__contains="dont_show")
+
 
 class CustomAdminWithCustomTemplate(admin.ModelAdmin):
     model = CustomAdminModel2

tests/tests.py

@@ -144,6 +144,22 @@ def test_get_fieldsets(self):
         self.assertContains(response, expected_fieldset_group_1, html=True)
         self.assertContains(response, expected_fieldset_group_2, html=True)
 
+    def test_excluded_queryset(self):
+        """ Ensure, that the user with name dont_show is excluded from the view
+        """
+        models = [
+            CustomAdminModel.objects.create(name="dont_show"),
+        ]
+        response = self.client.get(get_massadmin_url(models, self.client.session))
+        self.assertEqual(response.status_code, 404)
+
+        self.assertContains(
+            response,
+            "<p>The requested resource was not found on this server.</p>",
+            html=True,
+            status_code=404,
+        )
+
 
 class CustomizationTestCase(TestCase):
     """ MassAdmin has all customized options from related ModelAdmin