I see "Refused to execute inline script", is that a JavaScript bug?

It is a Content-Security-Policy block, and it breaks JavaScript just the same. Your CSP header is rejecting an inline <script> or an onclick handler because it lacks the right nonce or hash. The wrong fix is to disable CSP entirely, that removes a real security layer. We fix it correctly by adding the script to the policy with a nonce or hash, or by moving the inline code into a permitted external file, so the script runs and your CSP stays intact.