diff --git a/file_entity.admin.inc b/file_entity.admin.inc
index 6c97907..a87c4be 100644
--- a/file_entity.admin.inc
+++ b/file_entity.admin.inc
@@ -276,8 +276,6 @@ function file_entity_admin_file($form, $form_state) {
  * Form builder: Builds the file administration overview.
  */
 function file_entity_admin_files() {
-  global $user;
-
   $admin_access = user_access('administer files');
 
   // Build the 'Update options' form.
@@ -318,43 +316,11 @@ function file_entity_admin_files() {
   $query = db_select('file_managed', 'fm')->extend('PagerDefault')->extend('TableSort');
   file_entity_build_filter_query($query);
 
-  if (user_access('bypass file access')) {
-    // Administrators don't need to be restricted to only permanent files.
-    $query->condition('fm.status', FILE_STATUS_PERMANENT);
-  }
-  elseif (user_access('view files')) {
-    // For non-private files, users can view if they have the 'view files'
-    // permission.
-    $query->condition('fm.status', FILE_STATUS_PERMANENT);
-  }
-  elseif (user_access('view private files') && user_is_logged_in()) {
-    // For private files, users can view private files if the
-    // user is not anonymous, and has the 'view private files' permission.
-    $query->condition('fm.uri', db_like('private://') . '%', 'LIKE');
-    $query->condition('fm.status', FILE_STATUS_PERMANENT);
-  }
-  elseif (user_access('view own files')) {
-    // For non-private files, allow to see if user owns the file.
-    $query->condition('fm.uid', $user->uid, '=');
-    $query->condition('fm.status', FILE_STATUS_PERMANENT);
-  }
-  elseif (user_access('view own private files') && user_is_logged_in()) {
-    // For private files, users can view their own private files if the
-    // user is not anonymous, and has the 'view own private files' permission.
-    $query->condition('fm.uri', db_like('private://') . '%', 'LIKE');
-    $query->condition('fm.uid', $user->uid, '=');
-    $query->condition('fm.status', FILE_STATUS_PERMANENT);
-  }
-
-  foreach (array_keys(file_entity_get_hidden_stream_wrappers()) as $name) {
-    $query->condition('fm.uri', $name . '%', 'NOT LIKE');
-  }
-
   $fids = $query
     ->fields('fm', array('fid'))
     ->limit(50)
     ->orderByHeader($header)
-    ->addTag('admin_files')
+    ->addTag('file_access')
     ->execute()
     ->fetchCol();
   $files = file_load_multiple($fids);
diff --git a/file_entity.module b/file_entity.module
index 287be1f..12dbc1c 100644
--- a/file_entity.module
+++ b/file_entity.module
@@ -533,34 +533,6 @@ function file_entity_search_execute($keys = NULL, $conditions = NULL) {
   $query->join('file_managed', 'fm', 'fm.fid = i.sid');
   $query->searchExpression($keys, 'file');
 
-  if (user_access('bypass file access')) {
-    // Administrators don't need to be restricted to only permanent files.
-    $query->condition('fm.status', FILE_STATUS_PERMANENT);
-  }
-  elseif (user_access('view files')) {
-    // For non-private files, users can view if they have the 'view files'
-    // permission.
-    $query->condition('fm.status', FILE_STATUS_PERMANENT);
-  }
-  elseif (user_access('view private files') && user_is_logged_in()) {
-    // For private files, users can view private files if the
-    // user is not anonymous, and has the 'view private files' permission.
-    $query->condition('fm.uri', db_like('private://') . '%', 'LIKE');
-    $query->condition('fm.status', FILE_STATUS_PERMANENT);
-  }
-  elseif (user_access('view own files')) {
-    // For non-private files, allow to see if user owns the file.
-    $query->condition('fm.uid', $user->uid, '=');
-    $query->condition('fm.status', FILE_STATUS_PERMANENT);
-  }
-  elseif (user_access('view own private files') && user_is_logged_in()) {
-    // For private files, users can view their own private files if the
-    // user is not anonymous, and has the 'view own private files' permission.
-    $query->condition('fm.uri', db_like('private://') . '%', 'LIKE');
-    $query->condition('fm.uid', $user->uid, '=');
-    $query->condition('fm.status', FILE_STATUS_PERMANENT);
-  }
-
   // Insert special keywords.
   $query->setOption('type', 'fm.type');
   if ($query->setOption('term', 'ti.tid')) {
@@ -577,6 +549,7 @@ function file_entity_search_execute($keys = NULL, $conditions = NULL) {
   // Load results.
   $find = $query
     ->limit(10)
+    ->addTag('file_access')
     ->execute();
   $results = array();
   foreach ($find as $item) {
@@ -1680,6 +1653,45 @@ function file_entity_file_entity_access($op, $file, $account) {
 }
 
 /**
+ * Implements hook_query_TAG_alter.
+ */
+function file_entity_query_file_access_alter(QueryAlterableInterface $query) {
+  global $user;
+
+  if (user_access('bypass file access')) {
+    // Administrators don't need to be restricted to only permanent files.
+    $query->condition('fm.status', FILE_STATUS_PERMANENT);
+  }
+  elseif (user_access('view files')) {
+    // For non-private files, users can view if they have the 'view files'
+    // permission.
+    $query->condition('fm.status', FILE_STATUS_PERMANENT);
+  }
+  elseif (user_access('view private files') && user_is_logged_in()) {
+    // For private files, users can view private files if the
+    // user is not anonymous, and has the 'view private files' permission.
+    $query->condition('fm.uri', db_like('private://') . '%', 'LIKE');
+    $query->condition('fm.status', FILE_STATUS_PERMANENT);
+  }
+  elseif (user_access('view own files')) {
+    // For non-private files, allow to see if user owns the file.
+    $query->condition('fm.uid', $user->uid, '=');
+    $query->condition('fm.status', FILE_STATUS_PERMANENT);
+  }
+  elseif (user_access('view own private files') && user_is_logged_in()) {
+    // For private files, users can view their own private files if the
+    // user is not anonymous, and has the 'view own private files' permission.
+    $query->condition('fm.uri', db_like('private://') . '%', 'LIKE');
+    $query->condition('fm.uid', $user->uid, '=');
+    $query->condition('fm.status', FILE_STATUS_PERMANENT);
+  }
+
+  foreach (array_keys(file_entity_get_hidden_stream_wrappers()) as $name) {
+    $query->condition('fm.uri', $name . '%', 'NOT LIKE');
+  }
+}
+
+/**
  * Implements hook_file_download().
  */
 function file_entity_file_download($uri) {