# Comments Panel, security and attachment issues

**URL:** <https://forum.inductiveautomation.com/t/comments-panel-security-and-attachment-issues/6722>\
**Category:** Ignition\
**Created:** [June 17, 2013, 3:43pm UTC](https://forum.inductiveautomation.com/t/comments-panel-security-and-attachment-issues/6722 "2013-06-17T15:43:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![thierryv](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@thierryv](https://forum.inductiveautomation.com/u/thierryv)\
**Post date:** [June 17, 2013, 3:43pm UTC](https://forum.inductiveautomation.com/t/comments-panel-security-and-attachment-issues/6722/1 "2013-06-17T15:43:52Z")

</div>

The comments panel is working as expected, I can save and delete notes.  
When I set ‘attachments enabled’ to false I get the following error:

GatewayException: SQL error for “INSERT INTO NotesModificationsDone (NoteText, UserName, TimeStamp, Attachment, AttachmentName, IsSticky) VALUES (?, ‘thierry’, CURRENT\_TIMESTAMP, CAST(? AS VARBINARY(MAX)), ?, ?)”: The value is not set for the parameter number 3.  
caused by SQLServerException: The value is not set for the parameter number 3.

Ignition v7.5.6 (b1316)  
Java: Oracle Corporation 1.7.0\_21

When I use the comments panel and set the security settings to ‘Hide’ then this is working as expected.  
When I set the security settings to ‘Disable events’ it doesn’t work. Every user can add notes…

Thanks

---

<div class="post-metadata">

**Author:** ![Carl.Gould](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/carl.gould/32/7262_2.png) [@Carl.Gould](https://forum.inductiveautomation.com/u/Carl.Gould)\
**Post date:** [August 14, 2013, 3:36am UTC](https://forum.inductiveautomation.com/t/comments-panel-security-and-attachment-issues/6722/2 "2013-08-14T03:36:37Z")

</div>

It seems like you’re describing multiple things here.

1. Uploading attachments not working: looks like the query is failing. Maybe you can post the whole stack trace? Have you tried it without the cast?

2. This isn’t a bug. All “disable events” does is disable the event scripts on that component. This has nothing to do with the built-in functionality of the component. That said - we should add a disable mode for the security settings on this component that would disable the built-in functionality.

---

<div class="post-metadata">

**Author:** ![samson.miller](https://avatars.discourse-cdn.com/v4/letter/s/e9bcb4/32.png) [@samson.miller](https://forum.inductiveautomation.com/u/samson.miller)\
**Post date:** [August 16, 2013, 6:59pm UTC](https://forum.inductiveautomation.com/t/comments-panel-security-and-attachment-issues/6722/3 "2013-08-16T18:59:56Z")

</div>

A disable mode for the security settings on this component that has been added for v7.6.4.