Added documentation and CHANGELOG item

6 files changed, 6 insertions, 5 deletions

diff --git a/CHANGELOG b/CHANGELOG
index a50624922bb..3adbb0d8927 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -51,6 +51,7 @@ v 8.11.0 (unreleased)
   - Get issue and merge request description templates from repositories
   - Add hover state to todos !5361 (winniehell)
   - Fix icon alignment of star and fork buttons !5451 (winniehell)
+  - Enforce 2FA restrictions on API authentication endpoints !5820
   - Limit git rev-list output count to one in forced push check
   - Show deployment status on merge requests with external URLs
   - Clean up unused routes (Josef Strzibny)
diff --git a/app/services/user_retrieval_service.rb b/app/services/user_retrieval_service.rb
index 299fafca32d..94ea087d60b 100644
--- a/app/services/user_retrieval_service.rb
+++ b/app/services/user_retrieval_service.rb
@@ -10,4 +10,4 @@ class UserRetrievalService
     user = Gitlab::Auth.find_with_user_password(login, password)
     user unless user.two_factor_enabled?
   end
-end
\ No newline at end of file
+end
diff --git a/doc/api/oauth2.md b/doc/api/oauth2.md
index 16ef79617c0..0b0fc39ec7e 100644
--- a/doc/api/oauth2.md
+++ b/doc/api/oauth2.md
@@ -90,7 +90,7 @@ curl --header "Authorization: Bearer OAUTH-TOKEN" https://localhost:3000/api/v3/
 
 ## Deprecation Notice
 
-1. Starting in GitLab 9.0, the Resource Owner Password Credentials will be *disabled* for users with two-factor authentication turned on.
+1. Starting in GitLab 8.11, the Resource Owner Password Credentials has been *disabled* for users with two-factor authentication turned on.
 2. These users can access the API using [personal access tokens] instead.
 
 ---
diff --git a/doc/api/session.md b/doc/api/session.md
index 9076c48b899..f776424023e 100644
--- a/doc/api/session.md
+++ b/doc/api/session.md
@@ -2,7 +2,7 @@
 
 ## Deprecation Notice
 
-1. Starting in GitLab 9.0, this feature will be *disabled* for users with two-factor authentication turned on.
+1. Starting in GitLab 8.11, this feature has been *disabled* for users with two-factor authentication turned on.
 2. These users can access the API using [personal access tokens] instead.
 
 ---
diff --git a/spec/requests/api/oauth_tokens_spec.rb b/spec/requests/api/oauth_tokens_spec.rb
index 4730e9aa13c..dbe30f264dd 100644
--- a/spec/requests/api/oauth_tokens_spec.rb
+++ b/spec/requests/api/oauth_tokens_spec.rb
@@ -28,4 +28,4 @@ describe API::API, api: true  do
       end
     end
   end
-end
\ No newline at end of file
+end
diff --git a/spec/services/user_retrieval_service_spec.rb b/spec/services/user_retrieval_service_spec.rb
index 82a00e44345..6344db0a1c3 100644
--- a/spec/services/user_retrieval_service_spec.rb
+++ b/spec/services/user_retrieval_service_spec.rb
@@ -16,4 +16,4 @@ describe UserRetrievalService, services: true do
       expect(retrieved_user).to be_nil
     end
   end
-end
\ No newline at end of file
+end