Hi I have set profile privacy as public and friend privacy as friends, but on wall appears that user XY is now friend with user WY, so like this every user can see friends of user within be friend with him...

Hi Jan.

To be honest I'm not sure if this's a bug or not, but you can always unpublissh user rules "Approve Friend Request", and it'll hide those actions from activity stream.

Sorry, but where can unpublished that, thanks you very much

back-end>jomsocial>configuration>user points

Its works, but i think that this is bug

Like I said, I'm gonna pass it to our developers, and we'll see if we should consider this as something to fix in future versions.