ACP2E-3233: Admin can still place order even without payment method

Author: Chhandak.Barua

app/code/Magento/Sales/Controller/Adminhtml/Order/Create.php

@@ -280,6 +280,8 @@ protected function _processActionData($action = null)
 
         if ($paymentData = $this->getRequest()->getPost('payment')) {
             $this->_getOrderCreateModel()->getQuote()->getPayment()->addData($paymentData);
+        } else {
+            $this->_getOrderCreateModel()->getQuote()->getPayment()->setMethod('');
         }
 
         $eventData = [
@@ -293,6 +295,8 @@ protected function _processActionData($action = null)
 
         if ($paymentData = $this->getRequest()->getPost('payment')) {
             $this->_getOrderCreateModel()->getQuote()->getPayment()->addData($paymentData);
+        } else {
+            $this->_getOrderCreateModel()->getQuote()->getPayment()->setMethod('');
         }
 
         /**

app/code/Magento/Sales/view/adminhtml/templates/order/create/billing/method/form.phtml

@@ -92,13 +92,5 @@ script;
     <?= /* @noEscape */
     $secureRenderer->renderTag('script', [], $scriptString, false) ?>
 <?php else: ?>
-    <div class="admin__message-empty"><?= $escaper->escapeHtml(__('No Payment Methods')); ?>
-        <span class="no-display">
-            <input id="p_method"
-                   value="<?= $escaper->escapeHtmlAttr(''); ?>"
-                   type="text"
-                   name="payment[method]" class="admin__control-radio"
-                   checked="checked"/>
-        </span>
-    </div>
+    <div class="admin__message-empty"><?= $escaper->escapeHtml(__('No Payment Methods')); ?></div>
 <?php endif; ?>