I try to implement facebook login and data posted to timeline(I'd like to allow user to share app screenshots on his Facebook News Feed).
Everything works ok with developer account, but not for normal account: the access token only contains basic_info(read permission), publish_actions not work at all, though the open session callback return success!.
I heard that now facebook publish_actions need to be approved before working, is this correct?
Yes, this is the case if you use an app which was created after April 30th, 2014. Have a look at the Facebook Login Review FAQs to get an idea of the review process.