Cheaters behind proxies can vote many times!

When the user is behind a proxy and votes as anonymous the module allows multiple votes. Such users use this hole to cheat and valuably increase rating.

This defect was found in the _fivestar_cast_vote($type, $cid, $value) function.
Here is a piece of code where you assign $_SERVER['HTTP_X_FORWARDED_FOR'] to $hostname variable.

    if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
      $hostname = $_SERVER['HTTP_X_FORWARDED_FOR'];
    }
    else {
      $hostname = $_SERVER['REMOTE_ADDR'];
    }

And here is how votingapi.module saves such IPs (it concatenates REMOTE_ADDR and HTTP_X_FORWARDED_FOR:

  $vobj->hostname = $_SERVER['REMOTE_ADDR'];
  // Append internal IP if it exists.
  if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
    $vobj->hostname .= '-'. $_SERVER['HTTP_X_FORWARDED_FOR'];
  }

I propose you to change your code to this one:

    $hostname = $_SERVER['REMOTE_ADDR'];
    if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
      $hostname .= '-'. $_SERVER['HTTP_X_FORWARDED_FOR'];
    }

Thanks.