Since the messages are just list items should be able to attach files to them. This is a larger feature. Also, for this to work without a postback, an iframe is needed, they aren't that secure. This could be a setting to turn on or off.
To upload designs, you'll need to enable LFS. More information