Index: applications/order/script/org/ofbiz/order/order/OrderServices.xml
===================================================================
--- applications/order/script/org/ofbiz/order/order/OrderServices.xml	(revision 1058489)
+++ applications/order/script/org/ofbiz/order/order/OrderServices.xml	(working copy)
@@ -599,10 +599,6 @@
     </simple-method>
 
     <simple-method method-name="recreateOrderAdjustments" short-description="Auto create OrderAdjustments">
-        <check-permission permission="ORDERMGR" action="_UPDATE">
-            <fail-property resource="OrderErrorUiLabels" property="OrderSecurityErrorToRunAutoCreateOrderAdjustments"/>
-        </check-permission>
-        <check-errors/>
         <entity-one entity-name="OrderHeader" value-field="order" auto-field-map="true"/>
         <!-- all existing promo order items are cancelled -->
         <get-related value-field="order" relation-name="OrderItem" list="orderItems"/>
Index: specialpurpose/ecommerce/webapp/ecommerce/order/orderitems.ftl
===================================================================
--- specialpurpose/ecommerce/webapp/ecommerce/order/orderitems.ftl	(revision 1058489)
+++ specialpurpose/ecommerce/webapp/ecommerce/order/orderitems.ftl	(working copy)
@@ -222,7 +222,7 @@
             ${uiLabelMap.CommonComments}
             <input class="inputBox" type="text" name="icm_${orderItem.orderItemSeqId}" value="" size="30" maxlength="60"/>
           </td>
-          <td colspan="4"><a href="javascript:document.addCommonToCartForm.action='<@ofbizUrl fullPath="true">cancelOrderItem</@ofbizUrl>';document.addCommonToCartForm.submit()" class="buttontext">${uiLabelMap.CommonCancel}</a>
+          <td colspan="4"><a href="javascript:document.addCommonToCartForm.action='<@ofbizUrl>cancelOrderItem</@ofbizUrl>';document.addCommonToCartForm.submit()" class="buttontext">${uiLabelMap.CommonCancel}</a>
             <input type="hidden" name="orderItemSeqId" value="${orderItem.orderItemSeqId}"/>
           </td>
         </tr>
Index: applications/order/script/org/ofbiz/order/order/OrderSimpleMethods.xml
===================================================================
--- applications/order/script/org/ofbiz/order/order/OrderSimpleMethods.xml	(revision 1058489)
+++ applications/order/script/org/ofbiz/order/order/OrderSimpleMethods.xml	(working copy)
@@ -20,12 +20,21 @@
 
 <simple-methods xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:noNamespaceSchemaLocation="http://ofbiz.apache.org/dtds/simple-methods.xsd">
+
+    <!-- Returns hasPermission=true if userLogin partyId equals partyId parameter
+         Only the order owner should be able to cancel an item from Ecommerce
+    -->
+    <simple-method method-name="orderAdjustmentPermissionCheck" short-description="Party contact mech permission logic">
+        <if-empty field="parameters.partyId">
+            <set field="parameters.partyId" from-field="userLogin.partyId"/>
+        </if-empty>
+        <if-compare-field to-field="userLogin.partyId" field="parameters.partyId" operator="equals">
+            <set field="hasPermission" type="Boolean" value="true"/>
+            <field-to-result field="hasPermission"/>
+        </if-compare-field>
+    </simple-method>
+
     <simple-method method-name="createOrderAdjustment" short-description="Create an OrderAdjustment">
-        <check-permission permission="ORDERMGR" action="_CREATE">
-            <alt-permission permission="ORDERMGR_ROLE" action="_CREATE"/>
-            <fail-property resource="OrderErrorUiLabels" property="OrderSecurityErrorToRunCreateOrderAdjustement"/>
-        </check-permission>
-        <check-errors/>
 
         <make-value entity-name="OrderAdjustment" value-field="newEntity"/>
         <set-nonpk-fields map="parameters" value-field="newEntity"/>
Index: applications/order/servicedef/services.xml
===================================================================
--- applications/order/servicedef/services.xml	(revision 1058489)
+++ applications/order/servicedef/services.xml	(working copy)
@@ -181,9 +181,20 @@
         <attribute name="shipmentReceiptId" type="String" mode="IN" optional="true"/>
     </service>
 
+    <service name="orderAdjustmentPermissionCheck" engine="simple"
+            location="component://order/script/org/ofbiz/order/order/OrderSimpleMethods.xml" invoke="orderAdjustmentPermissionCheck">
+        <description>
+            Performs a party contact mech security check. The userLogin partyId must equal the partyId parameter.
+            Only the order owner should be able to cancel an item from Ecommerce.
+        </description>
+        <implements service="permissionInterface"/>
+        <attribute name="partyId" type="String" mode="IN" optional="true"/>
+    </service>
+
     <service name="createOrderAdjustment" default-entity-name="OrderAdjustment" engine="simple"
             location="component://order/script/org/ofbiz/order/order/OrderSimpleMethods.xml" invoke="createOrderAdjustment">
         <description>Creates a new order adjustment record</description>
+        <permission-service service-name="orderAdjustmentPermissionCheck" main-action="CREATE"/>
         <auto-attributes mode="OUT" include="pk" optional="false"/>
         <auto-attributes mode="IN" include="nonpk" optional="true"/>
         <override name="orderAdjustmentTypeId" optional="false"/>
@@ -355,6 +366,7 @@
     <service name="recreateOrderAdjustments" engine="simple" auth="true"
             location="component://order/script/org/ofbiz/order/order/OrderServices.xml" invoke="recreateOrderAdjustments">
         <description>Remove all existing order adjustments, recalc them and persist in OrderAdjustment.</description>
+        <permission-service service-name="orderAdjustmentPermissionCheck" main-action="UPDATE"/>
         <attribute name="orderId" type="String" mode="IN" optional="false"/>
     </service>