Letterboxing is enabled in priviledged contexts too
It seems harmless, isn't it? Or is it because some JS may be used to capture screen size with PDFs? For view-source: I can't think of any scenario.
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information