ACP2E-3233: Admin can still place order even without payment method

Author: Chhandak.Barua

app/code/Magento/Payment/Plugin/AdminSetPaymentMethod.php

@@ -35,9 +35,7 @@ public function __construct(
      */
     public function beforeImportPostData(Create $subject, array $data)
     {
-        if (!isset($data['payment_method'])
-            && ($_POST)
-            && !isset($this->request->getParam('payment')['method'])) {
+        if (isset($this->request->getParam('payment')['method'])) {
             $subject->setPaymentMethod('');
         }
     }

app/code/Magento/Sales/view/adminhtml/templates/order/create/billing/method/form.phtml

@@ -92,5 +92,13 @@ script;
     <?= /* @noEscape */
     $secureRenderer->renderTag('script', [], $scriptString, false) ?>
 <?php else: ?>
-    <div class="admin__message-empty"><?= $escaper->escapeHtml(__('No Payment Methods')); ?></div>
+    <div class="admin__message-empty"><?= $escaper->escapeHtml(__('No Payment Methods')); ?>
+        <span class="no-display">
+            <input id="p_method"
+                   value="<?= $escaper->escapeHtmlAttr(''); ?>"
+                   type="text"
+                   name="payment[method]" class="admin__control-radio"
+                   checked="checked"/>
+        </span>
+    </div>
 <?php endif; ?>