ACP2E-3233: Admin can still place order even without payment method

Author: Chhandak.Barua

app/code/Magento/Sales/Controller/Adminhtml/Order/Create.php

@@ -280,10 +280,8 @@ protected function _processActionData($action = null)
 
         if ($paymentData = $this->getRequest()->getPost('payment')) {
             $this->_getOrderCreateModel()->getQuote()->getPayment()->addData($paymentData);
-        } else {
-            $paymentData = array('method' => '');
-            $this->_getOrderCreateModel()->getQuote()->getPayment()->addData($paymentData);
         }
+
         $eventData = [
             'order_create_model' => $this->_getOrderCreateModel(),
             'request' => $this->getRequest()->getPostValue(),
@@ -293,12 +291,10 @@ protected function _processActionData($action = null)
 
         $this->_getOrderCreateModel()->saveQuote();
 
-        if ($paymentData = $this->getRequest()->getPost('payment')) {
-            $this->_getOrderCreateModel()->getQuote()->getPayment()->addData($paymentData);
-        } else {
+        if (!($paymentData = $this->getRequest()->getPost('payment'))) {
             $paymentData = array('method' => '');
-            $this->_getOrderCreateModel()->getQuote()->getPayment()->addData($paymentData);
         }
+        $this->_getOrderCreateModel()->getQuote()->getPayment()->addData($paymentData);
 
         /**
          * Saving of giftmessages