Cross-patient record access via trusted form_pid

Improper input validation in OpenEMR before 7.0.1 allows remote authenticated users to alter other patients' appointment records. The patient portal's add_edit_event_user.php trusts submitted form_pid values when creating appointments and notes instead of binding writes to the patient ID in the active session. A patient portal account is required, and exploitation can disclose or modify another patient's scheduling and note data without interrupting service.