diff --git a/protected_node.module b/protected_node.module
index 535538d..40ca55b 100644
--- a/protected_node.module
+++ b/protected_node.module
@@ -306,41 +306,49 @@ function protected_node_is_locked($nid, $op = 'access') {
  */
 function protected_node_and_attachment($filename) {
   global $user;
-
-  // the upload module glues the attachments and nodes together
-  // without that module, we cannot test anything here
-  // (it is not required anyway if the user is going to the /node/#
-  // page itself.)
-  if (user_access('bypass password protection') || !module_exists('upload')) {
+  
+  $fid = _protected_node_get_fid_from_filename($filename);
+  
+  // Bypass if file is not found in table_managed table
+  if (user_access('bypass password protection') || $fid === FALSE) {
     return FALSE;
   }
-
-  // check whether the node linked to this file attachment is protected
-  $sql = "SELECT u.nid, n.uid, pn.protected_node_passwd_changed"
-        . " FROM {files} f, {upload} u, {protected_nodes} pn, {node} n"
-        . " WHERE pn.nid = u.nid AND u.nid = n.nid AND f.filename = '%s' AND u.fid = f.fid"
-            . " AND pn.protected_node_is_protected = 1";
-  // TODO Please convert this statement to the D7 database API syntax.
-  $file_info = db_query($sql, $filename)->fetchAssoc();
-  if ($file_info === FALSE  // row doesn't exist, it's not protected
-   || ($user->uid && $user->uid == $file_info['uid'])) { // $user is the author
+  
+  $file = file_load($fid);
+  $usages = file_usage_list($file);
+  
+  // If the files isn't attached to a node we can't do anything
+  if (!isset($usages['file']['node'])) {
     return FALSE;
   }
-
-  // got the password?
-  if (isset($_SESSION['_protected_node']['passwords'][$file_info['nid']])) {
-    $when = $_SESSION['_protected_node']['passwords'][$file_info['nid']];
-    if ($when > $file_info['protected_node_passwd_changed']  // this page reset time
-     && $when > variable_get('protected_node_session_timelimit', 0)) { // global reset time
+  
+  // Load all nodes where this file is used
+  $nodes = node_load_multiple(array_keys($usages['file']['node']), array(), FALSE);
+
+  // Verify permission for each nodes which have this file
+  foreach ($nodes as $node) {
+    // File is accessible is the user has access to one node
+    if (!isset($node->nid) // row doesn't exist, it's not protected
+     || ($user->uid && $user->uid == $node->uid) // $user is the author
+     || $node->protected_node_is_protected == FALSE) {  // node is not protected
       return FALSE;
     }
-    // the session is out of date, we can as well get rid of it now
-    unset($_SESSION['_protected_node']['passwords'][$file_info['nid']]);
+
+    // got the password?
+    if (isset($_SESSION['_protected_node']['passwords'][$node->nid])) {
+      $when = $_SESSION['_protected_node']['passwords'][$node->nid];
+      if ($when > $node->protected_node_passwd_changed  // this page reset time
+       && $when > variable_get('protected_node_session_timelimit', 0)) { // global reset time
+        return FALSE;
+      }
+      // the session is out of date, we can as well get rid of it now
+      unset($_SESSION['_protected_node']['passwords'][$node->nid]);
+    }
   }
 
   // avoid the drupal_goto() if another module anyway forbids access
   // to the file
-  foreach (module_implements('file_download') as $module) {
+  /*foreach (module_implements('file_download') as $module) {
     // skip ourself, we already know the answer!
     if ($module != 'protected_node') {
       $function = $module . '_file_download';
@@ -351,10 +359,11 @@ function protected_node_and_attachment($filename) {
         return FALSE;
       }
     }
-  }
+  }*/
 
-  // no password, access denied
-  return $file_info['nid'];
+  // No password, access denied
+  // Return the first node nid
+  return reset($nodes)->nid;
 }
 
 
@@ -1060,3 +1069,24 @@ function protected_node_unlock($nid) {
   }
   return FALSE;
 }
+
+/**
+ * Get a $file->fid from a filename.
+ *
+ * \param[in] $filename  The name of the attachment file.
+ *
+ * \return FALSE if the file is not found. Return the first file->fid
+ *         if a file exists in the file_managed table with the same
+ *         filename.
+ */
+function _protected_node_get_fid_from_filename($filename) {
+  $result = db_select('file_managed', 'f')
+    ->fields('f', array('fid', 'filename', 'uri'))
+    ->condition('filename', $filename)
+    ->execute();
+  foreach ($result as $usage) {
+    // return the first fid
+    return $usage->fid;
+  }
+  return FALSE;
+}