ACP2E-3233: Admin can still place order even without payment method

Author: Chhandak.Barua

app/code/Magento/Sales/Controller/Adminhtml/Order/Create/Save.php

@@ -45,10 +45,6 @@ public function execute()
                 $this->_getOrderCreateModel()->setPaymentData($paymentData);
                 $this->_getOrderCreateModel()->getQuote()->getPayment()->addData($paymentData);
             }
-            elseif ($this->getRequest()->isPost()) {
-                $paymentData = array('method' => '');
-                $this->_getOrderCreateModel()->getQuote()->getPayment()->addData($paymentData);
-            }
 
             $order = $this->_getOrderCreateModel()
                 ->setIsValidate(true)

app/code/Magento/Sales/view/adminhtml/templates/order/create/billing/method/form.phtml

@@ -92,5 +92,13 @@ script;
     <?= /* @noEscape */
     $secureRenderer->renderTag('script', [], $scriptString, false) ?>
 <?php else: ?>
-    <div class="admin__message-empty"><?= $escaper->escapeHtml(__('No Payment Methods')); ?></div>
+    <div class="admin__message-empty"><?= $escaper->escapeHtml(__('No Payment Methods')); ?>
+        <span class="no-display">
+            <input id="p_method"
+                   value=""
+                   type="text"
+                   name="payment[method]" class="admin__control-radio"
+                   checked="checked"/>
+        </span>
+    </div>
 <?php endif; ?>