fix(sharebymail): do not escape the note mail heading twice

addHeading() already escapes its title, so a sharer display name
with & or ' showed up as & in the note mail.
DefaultShareProvider already passes the heading unescaped.

Assisted-by: ClaudeCode:claude-opus-5-5
Signed-off-by: John Molakvoæ <14975046+skjnldsv@users.noreply.github.com>

Author: skjnldsv

apps/sharebymail/lib/ShareByMailProvider.php

@@ -550,7 +550,7 @@ protected function sendNote(IShare $share): void {
 
 		$emailTemplate->setSubject($this->l->t('%s added a note to a file shared with you', [$initiatorDisplayName]));
 		$emailTemplate->addHeader();
-		$emailTemplate->addHeading(htmlspecialchars($htmlHeading), $plainHeading);
+		$emailTemplate->addHeading($htmlHeading, $plainHeading);
 		$emailTemplate->addBodyText(htmlspecialchars($note), $note);
 
 		$link = $this->urlGenerator->linkToRouteAbsolute('files_sharing.sharecontroller.showShare',

apps/sharebymail/tests/ShareByMailProviderTest.php

@@ -1974,4 +1974,39 @@ public function testSendMailNotificationWithDifferentUserAndNoUserEmailAndReplyT
 			[$share]
 		);
 	}
+
+	public function testSendNoteDoesNotEscapeHeading(): void {
+		$provider = $this->getInstance();
+		$initiatorUser = $this->createMock(IUser::class);
+		$initiatorUser->method('getDisplayName')->willReturn('Tom & Jerry\'s');
+		$initiatorUser->method('getEMailAddress')->willReturn(null);
+		$this->userManager->method('get')->with('InitiatorUser')->willReturn($initiatorUser);
+		$this->settingsManager->method('replyToInitiator')->willReturn(false);
+		$this->defaults->method('getName')->willReturn('UnitTestCloud');
+		$this->urlGenerator->method('linkToRouteAbsolute')->willReturn('https://example.com/file.txt');
+
+		$message = $this->createMock(Message::class);
+		$this->mailer->method('createMessage')->willReturn($message);
+		$template = $this->createMock(IEMailTemplate::class);
+		$this->mailer->method('createEMailTemplate')->willReturn($template);
+		$template
+			->expects($this->once())
+			->method('addHeading')
+			->with(
+				'Tom & Jerry\'s shared file.txt with you and wants to add',
+				'Tom & Jerry\'s shared file.txt with you and wants to add:'
+			);
+		$this->mailer->expects($this->once())->method('send')->with($message);
+
+		$node = $this->createMock(File::class);
+		$node->method('getName')->willReturn('file.txt');
+		$share = $this->createMock(IShare::class);
+		$share->method('getSharedBy')->willReturn('InitiatorUser');
+		$share->method('getSharedWith')->willReturn('john@doe.com');
+		$share->method('getNode')->willReturn($node);
+		$share->method('getNote')->willReturn('Some note');
+		$share->method('getToken')->willReturn('token');
+
+		self::invokePrivate($provider, 'sendNote', [$share]);
+	}
 }