ACP2E-3233: Admin can still place order even without payment method

Author: Chhandak.Barua

app/code/Magento/Sales/Controller/Adminhtml/Order/Create.php

@@ -291,10 +291,9 @@ protected function _processActionData($action = null)
 
         $this->_getOrderCreateModel()->saveQuote();
 
-        if (!($paymentData = $this->getRequest()->getPost('payment'))) {
-            $paymentData = array('method' => '');
+        if ($paymentData = $this->getRequest()->getPost('payment')) {
+            $this->_getOrderCreateModel()->getQuote()->getPayment()->addData($paymentData);
         }
-        $this->_getOrderCreateModel()->getQuote()->getPayment()->addData($paymentData);
 
         /**
          * Saving of giftmessages

app/code/Magento/Sales/Controller/Adminhtml/Order/Create/LoadBlock.php

@@ -90,6 +90,10 @@ public function execute()
             $this->storeManager->setCurrentStore($request->getParam('store_id'));
         }
         try {
+            if(!$request->getParam('payment')){
+                $paymentData = array('payment' => array('method' => ''));
+                $request->setParams($paymentData);
+            }
             $this->_initSession()->_processData();
         } catch (\Magento\Framework\Exception\LocalizedException $e) {
             $this->_reloadQuote();