Orphaner

Orphaner

Why Orphaner?

Drupal sites can accumulate stale files over time through development, deployments, module removal, migrations, testing, or manual changes.

Orphaner provides a lightweight command-line interface for inspecting a directory and removing individual files without requiring a full filesystem management solution.

It intentionally does **not** attempt to automatically determine whether a file is truly "orphaned." The administrator is responsible for identifying files that are safe to remove.

Installation

Install the module with Composer:

composer require drupal/orphaner

Enable the module:

drush en orphaner

Clear Drupal caches if necessary:

drush cr

Usage

Show the module location

drush orphaner

This prints the absolute filesystem path to the Orphaner module.

List files

Use `--list` to recursively list files below a directory:

drush orphaner --list /var/www/html/web/modules/contrib/orphaner

Hidden files are included in the listing.

Delete a file

Use `--delete` to remove one file:

drush orphaner --delete /var/www/html/web/modules/contrib/orphaner/test/deleteme.php

Or use the shorter command alias:

drush orph --delete /path/to/file

Orphaner only permits deletion of regular files. It will refuse to delete directories and other filesystem objects.

Before deleting a file, the command verifies that it exists. After running `rm`, it also verifies that the file has actually been removed.

Command reference

| Command | Description |
| ----------------------------------- | ---------------------------------------- |
| `drush orphaner` | Print the installed Orphaner module path |
| `drush orphaner --list ` | Recursively list files |
| `drush orphaner --delete ` | Delete one regular file |
| `drush orph ...` | Alias for `drush orphaner` |

File deletion and safety

The `--delete` operation is intentionally limited to **one regular file at a time** and only to the Drupal project in context.
You cannot delete any file outside the Drupal project.

Orphaner:

* Checks that the supplied path exists.
* Refuses to delete directories.
* Refuses to delete anything that is not a regular file.
* Passes the path to Symfony Process as a separate argument rather than constructing a shell command.
* Uses `rm --
` to prevent a filename beginning with `-` from being interpreted as an `rm` option.
* Verifies that the file no longer exists after the command completes.

However, `--delete` is a destructive operation. Always verify the supplied path before executing the command.

Security

Do not use `--delete` unless you are certain that the specified file can safely be removed!

If you believe you have found a security vulnerability, please follow the Drupal project's security reporting process rather than publicly disclosing the vulnerability in the issue queue.