diff --git a/plugins/dynamix/include/DeviceList.php b/plugins/dynamix/include/DeviceList.php
index 28a9b9a48..438928581 100644
--- a/plugins/dynamix/include/DeviceList.php
+++ b/plugins/dynamix/include/DeviceList.php
@@ -76,7 +76,9 @@ function device_desc(&$disk) {
 }
 function assignment(&$disk) {
   global $var, $devs;
-  $out = "<form method='POST' name=\"{$disk['name']}Form\" action='/update.htm' target='progressFrame'><input type='hidden' name='changeDevice' value='Apply'>";
+  $out = "<form method='POST' name=\"{$disk['name']}Form\" action='/update.htm' target='progressFrame'>";
+  $out .= "<input type='hidden' name='csrf_token' value='{$var['csrf_token']}'>";
+  $out .= "<input type='hidden' name='changeDevice' value='Apply'>";
   $out .= "<select class=\"slot\" name=\"slotId.{$disk['idx']}\" onChange=\"{$disk['name']}Form.submit()\">";
   $empty = ($disk['idSb']!='' ? 'no device' : 'unassigned');
   if ($disk['id']!='') {
@@ -267,6 +269,7 @@ function array_slots() {
   $min = max($var['sbNumDisks'], 3);
   $max = $var['MAX_ARRAYSZ'];
   $out = "<form method='POST' action='/update.htm' target='progressFrame'>";
+  $out .= "<input type='hidden' name='csrf_token' value='{$var['csrf_token']}'>";
   $out .= "<input type='hidden' name='changeSlots' value='Apply'>";
   $out .= "<select class='auto' name='SYS_ARRAY_SLOTS' onChange='this.form.submit()'>";
   for ($n=$min; $n<=$max; $n++) {
@@ -281,6 +284,7 @@ function cache_slots() {
   $min = $var['cacheSbNumDisks'];
   $max = $var['MAX_CACHESZ'];
   $out = "<form method='POST' action='/update.htm' target='progressFrame'>";
+  $out .= "<input type='hidden' name='csrf_token' value='{$var['csrf_token']}'>";
   $out .= "<input type='hidden' name='changeSlots' value='Apply'>";
   $out .= "<select class='auto' name='SYS_CACHE_SLOTS' onChange='this.form.submit()'>";
   for ($n=$min; $n<=$max; $n++) {