VSE: Remove the use of eval in Fades operators

Fix security issue introduced in rB2ec025d7be3c

Reviewed By: campbellbarton

Differential Revision: https://developer.blender.org/D5807

2 files changed, 14 insertions, 18 deletions

diff --git a/release/scripts/startup/bl_operators/sequencer.py b/release/scripts/startup/bl_operators/sequencer.py
index 35c7ad0b192..73a513829d8 100644
--- a/release/scripts/startup/bl_operators/sequencer.py
+++ b/release/scripts/startup/bl_operators/sequencer.py
@@ -150,15 +150,19 @@ class SequencerFadesClear(Operator):
         fcurves = context.scene.animation_data.action.fcurves
 
         for sequence in context.selected_sequences:
-            animated_property = 'volume' if hasattr(sequence, 'volume') else 'blend_alpha'
-            for curve in fcurves:
-                if not curve.data_path.endswith(animated_property):
-                    continue
-                # Ensure the fcurve corresponds to the selected sequence
-                if sequence == eval("bpy.context.scene." + curve.data_path.replace('.' + animated_property, '')):
-                    fcurves.remove(curve)
+            animated_property = "volume" if hasattr(sequence, "volume") else "blend_alpha"
+            data_path = sequence.path_from_id() + "." + animated_property
+            fcurve_map = {
+                curve.data_path: curve
+                for curve in fcurves
+                if curve.data_path.startswith("sequence_editor.sequences_all")
+            }
+            curve = fcurve_map.get(data_path)
+            if curve:
+                fcurves.remove(curve)
             setattr(sequence, animated_property, 1.0)
-        return {'FINISHED'}
+
+        return {"FINISHED"}
 
 
 class SequencerFadesAdd(Operator):
@@ -364,8 +368,6 @@ classes = (
     SequencerCrossfadeSounds,
     SequencerCutMulticam,
     SequencerDeinterlaceSelectedMovies,
-
-    # Disable until D5166#133312 is resolved.
-    # SequencerFadesClear,
-    # SequencerFadesAdd,
+    SequencerFadesClear,
+    SequencerFadesAdd,
 )
diff --git a/release/scripts/startup/bl_ui/space_sequencer.py b/release/scripts/startup/bl_ui/space_sequencer.py
index f664f4d6e72..397355f1f23 100644
--- a/release/scripts/startup/bl_ui/space_sequencer.py
+++ b/release/scripts/startup/bl_ui/space_sequencer.py
@@ -502,12 +502,9 @@ class SEQUENCER_MT_add(Menu):
         col.menu("SEQUENCER_MT_add_transitions", icon='ARROW_LEFTRIGHT')
         col.enabled = selected_sequences_len(context) >= 2
 
-        # Disable until D5166#133312 is resolved.
-        '''
         col = layout.column()
         col.operator_menu_enum("sequencer.fades_add", "type", text="Fade", icon="IPO_EASE_IN_OUT")
         col.enabled = selected_sequences_len(context) >= 1
-        '''
 
 
 class SEQUENCER_MT_add_empty(Menu):
@@ -778,13 +775,10 @@ class SEQUENCER_MT_context_menu(Menu):
                 layout.separator()
                 layout.operator("sequencer.crossfade_sounds", text="Crossfade Sounds")
 
-            # Disable until D5166#133312 is resolved.
-            '''
             if selected_sequences_count >= 1:
                 col = layout.column()
                 col.operator_menu_enum("sequencer.fades_add", "type", text="Fade")
                 layout.operator("sequencer.fades_clear", text="Clear Fade")
-            '''
 
             if strip_type in {
                     'CROSS', 'ADD', 'SUBTRACT', 'ALPHA_OVER', 'ALPHA_UNDER',