[1.11.x] Fixed #28066 -- Prevented SessionBase.cycle_key() from discarding data.

Backport of dda596ca32 from master

django/contrib/sessions/backends/base.py

@@ -306,10 +306,7 @@ class SessionBase(object):
         """
         Creates a new session key, while retaining the current session data.
         """
-        try:
-            data = self._session_cache
-        except AttributeError:
-            data = {}
+        data = self._session
         key = self.session_key
         self.create()
         self._session_cache = data

django/contrib/sessions/backends/signed_cookies.py

@@ -74,9 +74,8 @@ class SessionStore(SessionBase):
         generate a secure url-safe Base64-encoded string of data as our
         session key.
         """
-        session_cache = getattr(self, '_session_cache', {})
         return signing.dumps(
-            session_cache, compress=True,
+            self._session, compress=True,
             salt='django.contrib.sessions.backends.signed_cookies',
             serializer=self.serializer,
         )

docs/releases/1.11.1.txt

@@ -27,3 +27,6 @@ Bugfixes
 
 * Restored ``BoundField``\s without any ``choices`` evaluating to ``True``
   (:ticket:`28058`).
+
+* Prevented ``SessionBase.cycle_key()`` from losing session data if
+  ``_session_cache`` isn't populated (:ticket:`28066`).

tests/sessions_tests/tests.py

@@ -189,8 +189,13 @@ class SessionTestsMixin(object):
         self.assertEqual(list(self.session.items()), prev_data)
 
     def test_cycle_with_no_session_cache(self):
+        self.session['a'], self.session['b'] = 'c', 'd'
+        self.session.save()
+        prev_data = list(self.session.items())
+        self.session = self.backend(self.session.session_key)
         self.assertFalse(hasattr(self.session, '_session_cache'))
         self.session.cycle_key()
+        self.assertEqual(list(self.session.items()), prev_data)
 
     def test_save_doesnt_clear_data(self):
         self.session['a'] = 'b'