diff --git a/plugins/selection/EntityReference_SelectionHandler_Generic.class.php b/plugins/selection/EntityReference_SelectionHandler_Generic.class.php
index 35f06f5..fa8e536 100644
--- a/plugins/selection/EntityReference_SelectionHandler_Generic.class.php
+++ b/plugins/selection/EntityReference_SelectionHandler_Generic.class.php
@@ -306,6 +306,41 @@ class EntityReference_SelectionHandler_Generic implements EntityReference_Select
   public function getLabel($entity) {
     return entity_label($this->field['settings']['target_type'], $entity);
   }
+
+  /**
+   * Ensure a base table exists for the query.
+   *
+   * If we have a field-only query, we want to assure we have a base-table
+   * so we can later alter the query in entityFieldQueryAlter().
+   *
+   * @param $query
+   *   The Select query.
+   *
+   * @return
+   *   The alias of the base-table.
+   */
+  public function ensureBaseTable(SelectQueryInterface $query) {
+    $tables = $query->getTables();
+
+    // Check the current base table.
+    foreach ($tables as $table) {
+      if (empty($table['join'])) {
+        $alias = $table['alias'];
+      }
+    }
+
+    if (strpos($alias, 'field_data_') !== 0) {
+      // The existing base-table is the correct one.
+      return $alias;
+    }
+
+    // Join the known base-table.
+    $target_type = $this->field['settings']['target_type'];
+    $entity_info = entity_get_info($target_type);
+    $id = $entity_info['entity keys']['id'];
+    // Return the alias of the table.
+    return $query->innerJoin($target_type, NULL, "$target_type.$id = $alias.entity_id");
+  }
 }
 
 /**
@@ -321,8 +356,8 @@ class EntityReference_SelectionHandler_Generic_node extends EntityReference_Sele
     // modules in use on the site. As long as one access control module is there,
     // it is supposed to handle this check.
     if (!user_access('bypass node access') && !count(module_implements('node_grants'))) {
-      $tables = $query->getTables();
-      $query->condition(key($tables) . '.status', NODE_PUBLISHED);
+      $base_table = $this->ensureBaseTable($query);
+      $query->condition("$base_table.status", NODE_PUBLISHED);
     }
   }
 }
@@ -396,8 +431,8 @@ class EntityReference_SelectionHandler_Generic_comment extends EntityReference_S
     // requires us to also know about the concept of 'published' and
     // 'unpublished'.
     if (!user_access('administer comments')) {
-      $tables = $query->getTables();
-      $query->condition(key($tables) . '.status', COMMENT_PUBLISHED);
+      $base_table = $this->ensureBaseTable($query);
+      $query->condition("$base_table.status", COMMENT_PUBLISHED);
     }
 
     // The Comment module doesn't implement any proper comment access,
@@ -469,8 +504,7 @@ class EntityReference_SelectionHandler_Generic_taxonomy_term extends EntityRefer
     // The Taxonomy module doesn't implement any proper taxonomy term access,
     // and as a consequence doesn't make sure that taxonomy terms cannot be viewed
     // when the user doesn't have access to the vocabulary.
-    $tables = $query->getTables();
-    $base_table = key($tables);
+    $base_table = $this->ensureBaseTable($query);
     $vocabulary_alias = $query->innerJoin('taxonomy_vocabulary', 'n', '%alias.vid = ' . $base_table . '.vid');
     $query->addMetadata('base_table', $vocabulary_alias);
     // Pass the query to the taxonomy access control.
diff --git a/tests/entityreference.handlers.test b/tests/entityreference.handlers.test
index b0b904e..c3db472 100644
--- a/tests/entityreference.handlers.test
+++ b/tests/entityreference.handlers.test
@@ -459,4 +459,117 @@ class EntityReferenceHandlersTestCase extends DrupalWebTestCase {
     );
     $this->assertReferencable($field, $referencable_tests, 'Comment handler (comment + node admin)');
   }
+
+  /**
+   * Assert sorting by field works for non-admins.
+   *
+   * Since we are sorting on a field, we need to make sure the base-table
+   * is added, and access-control is behaving as expected.
+   */
+  public function testSortByField() {
+    // Add text field to entity, to sort by.
+    $field_info = array(
+      'field_name' => 'field_text',
+      'type' => 'text',
+      'entity_types' => array('node'),
+    );
+    field_create_field($field_info);
+
+    $instance = array(
+      'label' => 'Text Field',
+      'field_name' => 'field_text',
+      'entity_type' => 'node',
+      'bundle' => 'article',
+      'settings' => array(),
+      'required' => FALSE,
+    );
+    field_create_instance($instance);
+
+
+    // Build a fake field instance.
+    $field = array(
+      'translatable' => FALSE,
+      'entity_types' => array(),
+      'settings' => array(
+        'handler' => 'base',
+        'target_type' => 'node',
+        'handler_settings' => array(
+          'target_bundles' => array(),
+          // Add sorting.
+          'sort' => array(
+            'type' => 'field',
+            'field' => 'field_text:value',
+            'direction' => 'DESC',
+          ),
+        ),
+      ),
+      'field_name' => 'test_field',
+      'type' => 'entityreference',
+      'cardinality' => '1',
+    );
+
+    // Build a set of test data.
+    $nodes = array(
+      'published1' => (object) array(
+        'type' => 'article',
+        'status' => 1,
+        'title' => 'Node published1 (<&>)',
+        'uid' => 1,
+        'field_text' => array(
+          LANGUAGE_NONE => array(
+            array(
+              'value' => 1,
+            ),
+          ),
+        ),
+      ),
+      'published2' => (object) array(
+        'type' => 'article',
+        'status' => 1,
+        'title' => 'Node published2 (<&>)',
+        'uid' => 1,
+        'field_text' => array(
+          LANGUAGE_NONE => array(
+            array(
+              'value' => 2,
+            ),
+          ),
+        ),
+      ),
+      'unpublished' => (object) array(
+        'type' => 'article',
+        'status' => 0,
+        'title' => 'Node unpublished (<&>)',
+        'uid' => 1,
+        'field_text' => array(
+          LANGUAGE_NONE => array(
+            array(
+              'value' => 3,
+            ),
+          ),
+        ),
+      ),
+    );
+
+    $node_labels = array();
+    foreach ($nodes as $key => $node) {
+      node_save($node);
+      $node_labels[$key] = check_plain($node->title);
+    }
+
+    // Test as a non-admin.
+    $normal_user = $this->drupalCreateUser(array('access content'));
+    $GLOBALS['user'] = $normal_user;
+
+    $handler = entityreference_get_selection_handler($field);
+
+    // Not only assert the result, but make sure the keys are sorted as
+    // expected.
+    $result = $handler->getReferencableEntities();
+    $expected_result = array(
+      $nodes['published1']->nid => $node_labels['published1'],
+      $nodes['published2']->nid => $node_labels['published2'],
+    );
+    $this->assertEqual($result['article'], $expected_result, 'Query sorted by field returned expected vaules for non-admin.');
+  }
 }