Profile update notifications: small errors in URLs included in e-mail

When we activate the option to send a notification on profile-update, the e-mail sent has two errors:

1. the <a href= ... > doesn't put the URL in quotes
2. the URLs for the contactLink escapes "&" (amperstand) to "&", making the URL invalid in most e-mail clients.

My solution was to do:

1. Modify CRM/Core/BAO/CustomField.php, line 894 to add the quotes for the URL:
$result = "<a href=$url>{$value}</a>";
to
$result = "<a href='$url'>{$value}</a>";

2. Edit Core/BAO/UFGroup.php, line 1817, set the option "$htmlize = false" to url(), i.e.
$contactLink = CRM_Utils_System::url('civicrm/contact/view', "reset=1&cid=$contactID");
to
$contactLink = CRM_Utils_System::url('civicrm/contact/view', "reset=1&cid=$contactID", true, null, false);

However, I am not sure how to fix it for the custom-fields (our profile allows to upload an image).

Thanks,
Mathieu