diff --git a/lib/private/legacy/response.php b/lib/private/legacy/response.php
index 8937b56a70..115eb5baa6 100644
--- a/lib/private/legacy/response.php
+++ b/lib/private/legacy/response.php
@@ -253,7 +253,9 @@ class OC_Response {
 			. 'img-src * data: blob:; '
 			. 'font-src \'self\' data:; '
 			. 'media-src *; ' 
-			. 'connect-src *';
+			. 'connect-src *; '
+			. 'object-src \'none\'; '
+			. 'base-uri \'self\'; ';
 		header('Content-Security-Policy:' . $policy);
 		header('X-Frame-Options: Sameorigin'); // Disallow iFraming from other domains