Inline javascript handlers are not allowed by Content Security Policy. You should instead put it in https://github.com/owncloud/apps/blob/master/files_pdfviewer/js/on_event.js