If user.login fails, it will cause php errors

The PHP errors are caused by Views module: function views_check_roles

The BlogAPI module does the same thing as Services module: try to authenticate an account, and assign the result back to the global $user. However, if the user didn't succeed in logging in, then there is no $user object. That's why Views throw errors.

Since BlogAPI and Services use user_authenticate() in the same way, I mark this as a Views bug.

I haven't tested BlogAPI, but for a service request, Services don't call views_check_roles, but somehow views_check_roles gets called. In this particular example, user_authenticate() doesn't return a user object when the username or password is wrong, therefore views_check_roles throws errors.

any idea why views_check_roles gets called in a service request indirectly?

It seems that views_check_roles uses global $user as its fall back plan, and assumes that $user is a legit object. However, both BlogAPI and Services has something like $user = $user = user_authenticate(array('name' => $username, 'pass' => $password));, whose return is not always a user object.

I hope you guys could offer more advice, since I don't know enough about Views

according to http://api.drupal.org/api/drupal/modules--user--user.module/function/use..., user_authenticate does not always return a user object. So Views need to check if $user is empty or not?

No. we don't care about D6 services anymore.